github-actions[bot]
commented
11 months ago Terraform Format and Style 🖌``
Terraform Initialization ⚙️success
Terraform Validation 🤖success
Validation Output
``` Success! The configuration is valid. ```Terraform Plan 📖success
Show Plan
``` [command]/home/runner/work/_temp/e988bc5b-e51e-4ae2-a06d-4b84c6f2d008/terraform-bin show -no-color tfplan Note: Objects have changed outside of Terraform Terraform detected the following changes made outside of Terraform since the last "terraform apply" which may have affected this plan: # module.firewall[0].azurerm_firewall_application_rule_collection.azure_monitor has been deleted - resource "azurerm_firewall_application_rule_collection" "azure_monitor" { - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Azure-Monitor-FQDNs" -> null name = "Azure-Monitor-FQDNs" # (4 unchanged attributes hidden) # (1 unchanged block hidden) } # module.firewall[0].azurerm_firewall_application_rule_collection.core has been deleted - resource "azurerm_firewall_application_rule_collection" "core" { - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Core-Dependencies-FQDNs" -> null name = "Core-Dependencies-FQDNs" # (4 unchanged attributes hidden) # (3 unchanged blocks hidden) } # module.firewall[0].azurerm_firewall_application_rule_collection.windows_vm_devops has been deleted - resource "azurerm_firewall_application_rule_collection" "windows_vm_devops" { - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Devops-VM-Dependencies-FQDNs" -> null name = "Devops-VM-Dependencies-FQDNs" # (4 unchanged attributes hidden) # (2 unchanged blocks hidden) } # module.firewall[0].azurerm_firewall_network_rule_collection.windows_vm_devops has been deleted - resource "azurerm_firewall_network_rule_collection" "windows_vm_devops" { - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/networkRuleCollections/Windows-VM-Connectivity-Requirements" -> null name = "Windows-VM-Connectivity-Requirements" # (4 unchanged attributes hidden) # (2 unchanged blocks hidden) } Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to undo or respond to these changes. ───────────────────────────────────────────────────────────────────────────── Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # module.firewall[0].azurerm_firewall_application_rule_collection.azure_monitor will be created + resource "azurerm_firewall_application_rule_collection" "azure_monitor" { + action = "Allow" + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2" + id = (known after apply) + name = "Azure-Monitor-FQDNs" + priority = 201 + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2" + rule { + name = "allow-azure-monitor" + source_addresses = [ + "10.242.0.0/20", + "10.240.0.0/20", ] + target_fqdns = [ + "dc.applicationinsights.azure.com", + "dc.applicationinsights.microsoft.com", + "dc.services.visualstudio.com", + "*.in.applicationinsights.azure.com", + "live.applicationinsights.azure.com", + "rt.applicationinsights.microsoft.com", + "rt.services.visualstudio.com", + "*.livediagnostics.monitor.azure.com", + "*.monitoring.azure.com", + "agent.azureserviceprofiler.net", + "*.agent.azureserviceprofiler.net", + "*.monitor.azure.com", ] + protocol { + port = 443 + type = "Https" } } } # module.firewall[0].azurerm_firewall_application_rule_collection.core will be created + resource "azurerm_firewall_application_rule_collection" "core" { + action = "Allow" + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2" + id = (known after apply) + name = "Core-Dependencies-FQDNs" + priority = 200 + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2" + rule { + name = "allow-core-apis" + source_addresses = [ + "10.242.0.0/20", + "10.240.0.0/20", ] + target_fqdns = [ + "management.azure.com", + "management.core.windows.net", + "login.microsoftonline.com", + "login.windows.net", + "login.live.com", + "graph.windows.net", + "graph.microsoft.com", ] + protocol { + port = 443 + type = "Https" } } + rule { + name = "allow-developer-services" + source_addresses = [ + "10.242.0.0/20", + "10.240.0.0/20", ] + target_fqdns = [ + "github.com", + "*.github.com", + "*.nuget.org", + "*.blob.core.windows.net", + "*.githubusercontent.com", + "dev.azure.com", + "*.dev.azure.com", + "portal.azure.com", + "*.portal.azure.com", + "*.portal.azure.net", + "appservice.azureedge.net", + "*.azurewebsites.net", + "edge.management.azure.com", + "vstsagentpackage.azureedge.net", ] + protocol { + port = 443 + type = "Https" } } + rule { + name = "allow-certificate-dependencies" + source_addresses = [ + "10.242.0.0/20", + "10.240.0.0/20", ] + target_fqdns = [ + "*.delivery.mp.microsoft.com", + "ctldl.windowsupdate.com", + "download.windowsupdate.com", + "mscrl.microsoft.com", + "ocsp.msocsp.com", + "oneocsp.microsoft.com", + "crl.microsoft.com", + "www.microsoft.com", + "*.digicert.com", + "*.symantec.com", + "*.symcb.com", + "*.d-trust.net", ] + protocol { + port = 80 + type = "Http" } } } # module.firewall[0].azurerm_firewall_application_rule_collection.windows_vm_devops will be created + resource "azurerm_firewall_application_rule_collection" "windows_vm_devops" { + action = "Allow" + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2" + id = (known after apply) + name = "Devops-VM-Dependencies-FQDNs" + priority = 202 + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2" + rule { + name = "allow-azure-ad-join" + source_addresses = [ + "10.240.10.128/26", ] + target_fqdns = [ + "enterpriseregistration.windows.net", + "pas.windows.net", + "login.microsoftonline.com", + "device.login.microsoftonline.com", + "autologon.microsoftazuread-sso.com", + "manage-beta.microsoft.com", + "manage.microsoft.com", + "aadcdn.msauth.net", + "aadcdn.msftauth.net", + "aadcdn.msftauthimages.net", + "*.wns.windows.com", + "*.sts.microsoft.com", + "*.manage-beta.microsoft.com", + "*.manage.microsoft.com", ] + protocol { + port = 443 + type = "Https" } } + rule { + name = "allow-vm-dependencies-and-tools" + source_addresses = [ + "10.240.10.128/26", ] + target_fqdns = [ + "aka.ms", + "go.microsoft.com", + "download.microsoft.com", + "edge.microsoft.com", + "fs.microsoft.com", + "wdcp.microsoft.com", + "wdcpalt.microsoft.com", + "msedge.api.cdp.microsoft.com", + "winatp-gw-cane.microsoft.com", + "*.google.com", + "*.live.com", + "*.bing.com", + "*.msappproxy.net", + "*.delivery.mp.microsoft.com", + "*.data.microsoft.com", + "*.blob.storage.azure.net", + "*.blob.core.windows.net", + "*.dl.delivery.mp.microsoft.com", + "*.prod.do.dsp.mp.microsoft.com", + "*.update.microsoft.com", + "*.windowsupdate.com", + "*.apps.qualys.com", + "*.bootstrapcdn.com", + "*.jsdelivr.net", + "*.jquery.com", + "*.msecnd.net", ] + protocol { + port = 443 + type = "Https" } } } # module.firewall[0].azurerm_firewall_network_rule_collection.windows_vm_devops will be created + resource "azurerm_firewall_network_rule_collection" "windows_vm_devops" { + action = "Allow" + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2" + id = (known after apply) + name = "Windows-VM-Connectivity-Requirements" + priority = 202 + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2" + rule { + destination_addresses = [ + "20.118.99.224", + "40.83.235.53", + "23.102.135.246", + "51.4.143.248", + "23.97.0.13", + "52.126.105.2", ] + destination_ports = [ + "*", ] + name = "allow-kms-activation" + protocols = [ + "TCP", + "UDP", ] + source_addresses = [ + "10.240.10.128/26", ] } + rule { + destination_addresses = [ + "*", ] + destination_ports = [ + "123", ] + name = "allow-ntp" + protocols = [ + "TCP", + "UDP", ] + source_addresses = [ + "10.240.10.128/26", ] } } Plan: 4 to add, 0 to change, 0 to destroy. Changes to Outputs: ~ firewall_rules = { ~ azure_monitor = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Azure-Monitor-FQDNs" -> (known after apply) ~ core = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Core-Dependencies-FQDNs" -> (known after apply) ~ windows_vm_devops = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Devops-VM-Dependencies-FQDNs" -> (known after apply) ~ windows_vm_devops_net = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/networkRuleCollections/Windows-VM-Connectivity-Requirements" -> (known after apply) } ::debug::Terraform exited with code 0. ::debug::stdout: %0ANote: Objects have changed outside of Terraform%0A%0ATerraform detected the following changes made outside of Terraform since the%0Alast "terraform apply" which may have affected this plan:%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.azure_monitor has been deleted%0A - resource "azurerm_firewall_application_rule_collection" "azure_monitor" {%0A - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Azure-Monitor-FQDNs" -> null%0A name = "Azure-Monitor-FQDNs"%0A # (4 unchanged attributes hidden)%0A%0A # (1 unchanged block hidden)%0A }%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.core has been deleted%0A - resource "azurerm_firewall_application_rule_collection" "core" {%0A - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Core-Dependencies-FQDNs" -> null%0A name = "Core-Dependencies-FQDNs"%0A # (4 unchanged attributes hidden)%0A%0A # (3 unchanged blocks hidden)%0A }%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.windows_vm_devops has been deleted%0A - resource "azurerm_firewall_application_rule_collection" "windows_vm_devops" {%0A - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Devops-VM-Dependencies-FQDNs" -> null%0A name = "Devops-VM-Dependencies-FQDNs"%0A # (4 unchanged attributes hidden)%0A%0A # (2 unchanged blocks hidden)%0A }%0A%0A # module.firewall[0].azurerm_firewall_network_rule_collection.windows_vm_devops has been deleted%0A - resource "azurerm_firewall_network_rule_collection" "windows_vm_devops" {%0A - id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/networkRuleCollections/Windows-VM-Connectivity-Requirements" -> null%0A name = "Windows-VM-Connectivity-Requirements"%0A # (4 unchanged attributes hidden)%0A%0A # (2 unchanged blocks hidden)%0A }%0A%0A%0AUnless you have made equivalent changes to your configuration, or ignored the%0Arelevant attributes using ignore_changes, the following plan may include%0Aactions to undo or respond to these changes.%0A%0A─────────────────────────────────────────────────────────────────────────────%0A%0ATerraform used the selected providers to generate the following execution%0Aplan. Resource actions are indicated with the following symbols:%0A + create%0A%0ATerraform will perform the following actions:%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.azure_monitor will be created%0A + resource "azurerm_firewall_application_rule_collection" "azure_monitor" {%0A + action = "Allow"%0A + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2"%0A + id = (known after apply)%0A + name = "Azure-Monitor-FQDNs"%0A + priority = 201%0A + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2"%0A%0A + rule {%0A + name = "allow-azure-monitor"%0A + source_addresses = [%0A + "10.242.0.0/20",%0A + "10.240.0.0/20",%0A ]%0A + target_fqdns = [%0A + "dc.applicationinsights.azure.com",%0A + "dc.applicationinsights.microsoft.com",%0A + "dc.services.visualstudio.com",%0A + "*.in.applicationinsights.azure.com",%0A + "live.applicationinsights.azure.com",%0A + "rt.applicationinsights.microsoft.com",%0A + "rt.services.visualstudio.com",%0A + "*.livediagnostics.monitor.azure.com",%0A + "*.monitoring.azure.com",%0A + "agent.azureserviceprofiler.net",%0A + "*.agent.azureserviceprofiler.net",%0A + "*.monitor.azure.com",%0A ]%0A%0A + protocol {%0A + port = 443%0A + type = "Https"%0A }%0A }%0A }%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.core will be created%0A + resource "azurerm_firewall_application_rule_collection" "core" {%0A + action = "Allow"%0A + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2"%0A + id = (known after apply)%0A + name = "Core-Dependencies-FQDNs"%0A + priority = 200%0A + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2"%0A%0A + rule {%0A + name = "allow-core-apis"%0A + source_addresses = [%0A + "10.242.0.0/20",%0A + "10.240.0.0/20",%0A ]%0A + target_fqdns = [%0A + "management.azure.com",%0A + "management.core.windows.net",%0A + "login.microsoftonline.com",%0A + "login.windows.net",%0A + "login.live.com",%0A + "graph.windows.net",%0A + "graph.microsoft.com",%0A ]%0A%0A + protocol {%0A + port = 443%0A + type = "Https"%0A }%0A }%0A + rule {%0A + name = "allow-developer-services"%0A + source_addresses = [%0A + "10.242.0.0/20",%0A + "10.240.0.0/20",%0A ]%0A + target_fqdns = [%0A + "github.com",%0A + "*.github.com",%0A + "*.nuget.org",%0A + "*.blob.core.windows.net",%0A + "*.githubusercontent.com",%0A + "dev.azure.com",%0A + "*.dev.azure.com",%0A + "portal.azure.com",%0A + "*.portal.azure.com",%0A + "*.portal.azure.net",%0A + "appservice.azureedge.net",%0A + "*.azurewebsites.net",%0A + "edge.management.azure.com",%0A + "vstsagentpackage.azureedge.net",%0A ]%0A%0A + protocol {%0A + port = 443%0A + type = "Https"%0A }%0A }%0A + rule {%0A + name = "allow-certificate-dependencies"%0A + source_addresses = [%0A + "10.242.0.0/20",%0A + "10.240.0.0/20",%0A ]%0A + target_fqdns = [%0A + "*.delivery.mp.microsoft.com",%0A + "ctldl.windowsupdate.com",%0A + "download.windowsupdate.com",%0A + "mscrl.microsoft.com",%0A + "ocsp.msocsp.com",%0A + "oneocsp.microsoft.com",%0A + "crl.microsoft.com",%0A + "www.microsoft.com",%0A + "*.digicert.com",%0A + "*.symantec.com",%0A + "*.symcb.com",%0A + "*.d-trust.net",%0A ]%0A%0A + protocol {%0A + port = 80%0A + type = "Http"%0A }%0A }%0A }%0A%0A # module.firewall[0].azurerm_firewall_application_rule_collection.windows_vm_devops will be created%0A + resource "azurerm_firewall_application_rule_collection" "windows_vm_devops" {%0A + action = "Allow"%0A + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2"%0A + id = (known after apply)%0A + name = "Devops-VM-Dependencies-FQDNs"%0A + priority = 202%0A + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2"%0A%0A + rule {%0A + name = "allow-azure-ad-join"%0A + source_addresses = [%0A + "10.240.10.128/26",%0A ]%0A + target_fqdns = [%0A + "enterpriseregistration.windows.net",%0A + "pas.windows.net",%0A + "login.microsoftonline.com",%0A + "device.login.microsoftonline.com",%0A + "autologon.microsoftazuread-sso.com",%0A + "manage-beta.microsoft.com",%0A + "manage.microsoft.com",%0A + "aadcdn.msauth.net",%0A + "aadcdn.msftauth.net",%0A + "aadcdn.msftauthimages.net",%0A + "*.wns.windows.com",%0A + "*.sts.microsoft.com",%0A + "*.manage-beta.microsoft.com",%0A + "*.manage.microsoft.com",%0A ]%0A%0A + protocol {%0A + port = 443%0A + type = "Https"%0A }%0A }%0A + rule {%0A + name = "allow-vm-dependencies-and-tools"%0A + source_addresses = [%0A + "10.240.10.128/26",%0A ]%0A + target_fqdns = [%0A + "aka.ms",%0A + "go.microsoft.com",%0A + "download.microsoft.com",%0A + "edge.microsoft.com",%0A + "fs.microsoft.com",%0A + "wdcp.microsoft.com",%0A + "wdcpalt.microsoft.com",%0A + "msedge.api.cdp.microsoft.com",%0A + "winatp-gw-cane.microsoft.com",%0A + "*.google.com",%0A + "*.live.com",%0A + "*.bing.com",%0A + "*.msappproxy.net",%0A + "*.delivery.mp.microsoft.com",%0A + "*.data.microsoft.com",%0A + "*.blob.storage.azure.net",%0A + "*.blob.core.windows.net",%0A + "*.dl.delivery.mp.microsoft.com",%0A + "*.prod.do.dsp.mp.microsoft.com",%0A + "*.update.microsoft.com",%0A + "*.windowsupdate.com",%0A + "*.apps.qualys.com",%0A + "*.bootstrapcdn.com",%0A + "*.jsdelivr.net",%0A + "*.jquery.com",%0A + "*.msecnd.net",%0A ]%0A%0A + protocol {%0A + port = 443%0A + type = "Https"%0A }%0A }%0A }%0A%0A # module.firewall[0].azurerm_firewall_network_rule_collection.windows_vm_devops will be created%0A + resource "azurerm_firewall_network_rule_collection" "windows_vm_devops" {%0A + action = "Allow"%0A + azure_firewall_name = "sec-baseline-1-hub-westus3-fw-eslz2"%0A + id = (known after apply)%0A + name = "Windows-VM-Connectivity-Requirements"%0A + priority = 202%0A + resource_group_name = "sec-baseline-1-hub-westus3-rg-eslz2"%0A%0A + rule {%0A + destination_addresses = [%0A + "20.118.99.224",%0A + "40.83.235.53",%0A + "23.102.135.246",%0A + "51.4.143.248",%0A + "23.97.0.13",%0A + "52.126.105.2",%0A ]%0A + destination_ports = [%0A + "*",%0A ]%0A + name = "allow-kms-activation"%0A + protocols = [%0A + "TCP",%0A + "UDP",%0A ]%0A + source_addresses = [%0A + "10.240.10.128/26",%0A ]%0A }%0A + rule {%0A + destination_addresses = [%0A + "*",%0A ]%0A + destination_ports = [%0A + "123",%0A ]%0A + name = "allow-ntp"%0A + protocols = [%0A + "TCP",%0A + "UDP",%0A ]%0A + source_addresses = [%0A + "10.240.10.128/26",%0A ]%0A }%0A }%0A%0APlan: 4 to add, 0 to change, 0 to destroy.%0A%0AChanges to Outputs:%0A ~ firewall_rules = {%0A ~ azure_monitor = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Azure-Monitor-FQDNs" -> (known after apply)%0A ~ core = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Core-Dependencies-FQDNs" -> (known after apply)%0A ~ windows_vm_devops = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/applicationRuleCollections/Devops-VM-Dependencies-FQDNs" -> (known after apply)%0A ~ windows_vm_devops_net = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/sec-baseline-1-hub-westus3-rg-eslz2/providers/Microsoft.Network/azureFirewalls/sec-baseline-1-hub-westus3-fw-eslz2/networkRuleCollections/Windows-VM-Connectivity-Requirements" -> (known after apply)%0A }%0A ::debug::stderr: ::debug::exitcode: 0 ```Pusher: @JinLee794, Action: pull_request, Working Directory: scenarios/secure-baseline-multitenant/terraform/hub, Workflow: Scenario 1: Terraform HUB Multi-tenant Secure Baseline
Description
106
Pipeline references
Type of Change
Please delete options that are not relevant.
Checklist