ARM, CSPM and Terraform : Added prancer policies for Microsoft defender for cloud and CSPM for IAM

rezoan commented 1 year ago

Defander ARM:

PR-AZR-ARM-MDC-001: Azure Microsoft Defender for Cloud Defender plans should be set to On
PR-AZR-ARM-MDC-002: Azure Microsoft Defender for Cloud should be set to On for App Services
PR-AZR-ARM-MDC-003: Azure Microsoft Defender for Cloud should be set to On for Azure SQL Databases
PR-AZR-ARM-MDC-004: Azure Microsoft Defender for Cloud should be set to On for Key Vault
PR-AZR-ARM-MDC-005: Azure Microsoft Defender for Cloud should be set to On for SQL VM
PR-AZR-ARM-MDC-006: Azure Microsoft Defender for Cloud should be set to On for VMs
PR-AZR-ARM-MDC-007: Azure Microsoft Defender for Cloud should be set to On for Storage
PR-AZR-ARM-MDC-008: Azure Microsoft Defender for Cloud should be set to On for Containers
PR-AZR-ARM-MDC-009: Azure Microsoft Defender for Cloud MCAS integration should be enabled
PR-AZR-ARM-MDC-010: Azure Microsoft Defender for Cloud WDATP integration should be enabled
PR-AZR-ARM-MDC-011: Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs should be turned on
PR-AZR-ARM-MDC-012: Azure Microsoft Defender for Cloud security alert email notifications should be set to On
PR-AZR-ARM-MDC-013: Azure Microsoft Defender for Cloud email notification for subscription owner should be set to On
PR-AZR-ARM-MDC-014: Azure Microsoft Defender for Cloud security contact additional email should be set

Defender CSPM

PR-AZR-CLD-MDC-001: Azure Microsoft Defender for Cloud Defender plans should be set to On
PR-AZR-CLD-MDC-002: Azure Microsoft Defender for Cloud should be set to On for App Services
PR-AZR-CLD-MDC-003: Azure Microsoft Defender for Cloud should be set to On for Azure SQL Databases
PR-AZR-CLD-MDC-004: Azure Microsoft Defender for Cloud should be set to On for Key Vault
PR-AZR-CLD-MDC-005: Azure Microsoft Defender for Cloud should be set to On for SQL VM
PR-AZR-CLD-MDC-006: Azure Microsoft Defender for Cloud should be set to On for VMs
PR-AZR-CLD-MDC-007: Azure Microsoft Defender for Cloud should be set to On for Storage
PR-AZR-CLD-MDC-008: Azure Microsoft Defender for Cloud should be set to On for Containers
PR-AZR-CLD-MDC-009: Azure Microsoft Defender for Cloud MCAS integration should be enabled
PR-AZR-CLD-MDC-010: Azure Microsoft Defender for Cloud WDATP integration should be enabled
PR-AZR-CLD-MDC-011: Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs should be turned on
PR-AZR-CLD-MDC-012: Azure Microsoft Defender for Cloud security alert email notifications should be set to On
PR-AZR-CLD-MDC-013: Azure Microsoft Defender for Cloud email notification for subscription owner should be set to On
PR-AZR-CLD-MDC-014: Azure Microsoft Defender for Cloud security contact additional email should be set

Defender Terraform

PR-AZR-TRF-MDC-001: Azure Microsoft Defender for Cloud Defender plans should be set to On
PR-AZR-TRF-MDC-002: Azure Microsoft Defender for Cloud should be set to On for App Services
PR-AZR-TRF-MDC-003: Azure Microsoft Defender for Cloud should be set to On for Azure SQL Databases
PR-AZR-TRF-MDC-004: Azure Microsoft Defender for Cloud should be set to On for Key Vault
PR-AZR-TRF-MDC-005: Azure Microsoft Defender for Cloud should be set to On for SQL VM
PR-AZR-TRF-MDC-006: Azure Microsoft Defender for Cloud should be set to On for VMs
PR-AZR-TRF-MDC-007: Azure Microsoft Defender for Cloud should be set to On for Storage
PR-AZR-TRF-MDC-008: Azure Microsoft Defender for Cloud should be set to On for Containers
PR-AZR-TRF-MDC-009: Azure Microsoft Defender for Cloud MCAS integration should be enabled
PR-AZR-TRF-MDC-010: Azure Microsoft Defender for Cloud WDATP integration should be enabled
PR-AZR-TRF-MDC-011: Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs should be turned on
PR-AZR-TRF-MDC-012: Azure Microsoft Defender for Cloud security alert email notifications should be set to On
PR-AZR-TRF-MDC-013: Azure Microsoft Defender for Cloud email notification for subscription owner should be set to On
PR-AZR-TRF-MDC-014: Azure Microsoft Defender for Cloud security contact additional email should be set

IAM CSPM

PR-AZR-CLD-IAM-001: Azure custom role definition should not have overly permission
PR-AZR-CLD-IAM-002: Azure role assignments should not have implicit role management permissions
PR-AZR-CLD-IAM-003: Azure role assignments should not have implicit managed identity permissions
PR-AZR-CLD-IAM-004: Azure role assignments should not have implicit owner permissions
PR-AZR-CLD-IAM-005: Azure custom role definition should not have subscription owner permission
PR-AZR-CLD-IAM-006: Azure custom role definition should not have wildcard action
PR-AZR-CLD-IAM-007: Ensure to assign roles to groups, not users
PR-AZR-CLD-IAM-008: AAD should have security default enabled
PR-AZR-CLD-IAM-009: AAD non admin users should not have permission to create apps
PR-AZR-CLD-IAM-010: Ensure only AAD users assigned to specific admin roles can invite guest users
PR-AZR-CLD-IAM-011: AAD users should have MFA enabled
PR-AZR-CLD-IAM-012: AAD non admin users should not have permission to create security groups
PR-AZR-CLD-IAM-013: Ensure 'Users can consent to apps accessing company data on their behalf' configuration is disabled
PR-AZR-CLD-IAM-014: Ensure AAD dont have guest users

rezoan commented 1 year ago

farchide commented 1 year ago

@rezoan please provide the code, title for the policies we are adding with this PR

rezoan commented 1 year ago

@rezoan please provide the code, title for the policies we are adding with this PR

@farchide updated the PR description.

prancer-io / prancer-compliance-test