From 8463828ede17f78e97e7556adbc0d6b6a5a96926 Mon Sep 17 00:00:00 2001 From: BernieWhite Date: Mon, 8 Apr 2024 16:17:40 +0000 Subject: [PATCH] deploy: 74d0cf83322aa0a4912d524a9c662d0f9c53fded --- CHANGELOG-v1/index.html | 7 +- en/baselines/Azure.All/index.html | 2 +- en/baselines/Azure.Default/index.html | 2 +- en/baselines/Azure.GA_2023_06/index.html | 2 +- en/baselines/Azure.GA_2023_09/index.html | 2 +- en/baselines/Azure.GA_2023_12/index.html | 2 +- en/baselines/Azure.GA_2024_03/index.html | 2 +- en/baselines/Azure.MCSB.v1/index.html | 2 +- en/baselines/Azure.Pillar.Security/index.html | 2 +- en/baselines/Azure.Preview/index.html | 2 +- en/rules/Azure.PostgreSQL.AADOnly/index.html | 125 +- en/rules/Azure.PostgreSQL.MinTLS/index.html | 147 +- en/rules/Azure.PostgreSQL.UseSSL/index.html | 144 +- en/rules/index.html | 2 +- en/rules/metadata.json | 8762 ++++++++--------- en/rules/module/index.html | 36 +- en/rules/resource/index.html | 2 +- es/rules/index.html | 2 +- es/rules/metadata.json | 7992 +++++++-------- es/rules/module/index.html | 36 +- es/rules/resource/index.html | 2 +- examples-ML.bicep => examples-ml.bicep | 0 examples-ML.json => examples-ml.json | 0 examples-postgresql.bicep | 87 + examples-postgresql.json | 117 + hooks/__pycache__/aliases.cpython-311.pyc | Bin 4471 -> 4471 bytes hooks/__pycache__/metadata.cpython-311.pyc | Bin 4546 -> 4546 bytes hooks/__pycache__/old_hooks.cpython-311.pyc | Bin 16118 -> 16118 bytes hooks/__pycache__/shortcodes.cpython-311.pyc | Bin 8268 -> 8268 bytes search/search_index.json | 2 +- sitemap.xml.gz | Bin 4363 -> 4363 bytes 31 files changed, 8994 insertions(+), 8487 deletions(-) rename examples-ML.bicep => examples-ml.bicep (100%) rename examples-ML.json => examples-ml.json (100%) create mode 100644 examples-postgresql.bicep create mode 100644 examples-postgresql.json diff --git a/CHANGELOG-v1/index.html b/CHANGELOG-v1/index.html index 8ebb773b89c..02dfdf144ab 100644 --- a/CHANGELOG-v1/index.html +++ b/CHANGELOG-v1/index.html @@ -17561,6 +17561,11 @@

Unreleased#2789 +
  • Bug fixes:
      +
    • Fixed not found warning when exporting firewall policy signatureOverrides by @BernieWhite. + #2806
      • +
    +

    • v1.35.2#

    What's changed since v1.35.1:

    @@ -24428,7 +24433,7 @@

    v1.0.0-B2101006 (pre-release) - April 6, 2024 + April 8, 2024 diff --git a/en/baselines/Azure.All/index.html b/en/baselines/Azure.All/index.html index 779abfbdf28..dcab6a71fa2 100644 --- a/en/baselines/Azure.All/index.html +++ b/en/baselines/Azure.All/index.html @@ -14353,7 +14353,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.Default/index.html b/en/baselines/Azure.Default/index.html index 53ff141d723..befb7fe7970 100644 --- a/en/baselines/Azure.Default/index.html +++ b/en/baselines/Azure.Default/index.html @@ -14318,7 +14318,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.GA_2023_06/index.html b/en/baselines/Azure.GA_2023_06/index.html index 1aa5f2d84e8..812b6f20051 100644 --- a/en/baselines/Azure.GA_2023_06/index.html +++ b/en/baselines/Azure.GA_2023_06/index.html @@ -14178,7 +14178,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.GA_2023_09/index.html b/en/baselines/Azure.GA_2023_09/index.html index 8690cc7f784..3400ecf413e 100644 --- a/en/baselines/Azure.GA_2023_09/index.html +++ b/en/baselines/Azure.GA_2023_09/index.html @@ -14223,7 +14223,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.GA_2023_12/index.html b/en/baselines/Azure.GA_2023_12/index.html index 4c15e42fb43..4f8a47294f2 100644 --- a/en/baselines/Azure.GA_2023_12/index.html +++ b/en/baselines/Azure.GA_2023_12/index.html @@ -14268,7 +14268,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.GA_2024_03/index.html b/en/baselines/Azure.GA_2024_03/index.html index ea79f27a52e..13a2ebc0a31 100644 --- a/en/baselines/Azure.GA_2024_03/index.html +++ b/en/baselines/Azure.GA_2024_03/index.html @@ -14308,7 +14308,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.MCSB.v1/index.html b/en/baselines/Azure.MCSB.v1/index.html index d929523d00f..4a21f804b62 100644 --- a/en/baselines/Azure.MCSB.v1/index.html +++ b/en/baselines/Azure.MCSB.v1/index.html @@ -13562,7 +13562,7 @@

    ControlsAzure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.Pillar.Security/index.html b/en/baselines/Azure.Pillar.Security/index.html index 9e16ccce1ec..7296baac382 100644 --- a/en/baselines/Azure.Pillar.Security/index.html +++ b/en/baselines/Azure.Pillar.Security/index.html @@ -13794,7 +13794,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/baselines/Azure.Preview/index.html b/en/baselines/Azure.Preview/index.html index 8ec7d314c7f..a40f7e5a866 100644 --- a/en/baselines/Azure.Preview/index.html +++ b/en/baselines/Azure.Preview/index.html @@ -14353,7 +14353,7 @@

    Rules# Azure.PostgreSQL.AADOnly -Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. +Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. Important diff --git a/en/rules/Azure.PostgreSQL.AADOnly/index.html b/en/rules/Azure.PostgreSQL.AADOnly/index.html index d65d2f70dcb..bae7d7b02f2 100644 --- a/en/rules/Azure.PostgreSQL.AADOnly/index.html +++ b/en/rules/Azure.PostgreSQL.AADOnly/index.html @@ -6,7 +6,7 @@ - + @@ -82,19 +82,19 @@ - + - + - + @@ -115,7 +115,7 @@
    - + Skip to content @@ -13206,74 +13206,108 @@ -

    Azure AD-only authentication#

    +

    Entra ID only authentication with PostgreSQL databases#

    Security · Azure Database for PostgreSQL · Rule · 2023_06 · Important

    -

    Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases.

    +

    Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases.

    Description#

    -

    Azure Database for PostgreSQL supports authentication with PostgreSQL logins and Azure AD authentication.

    +

    Azure Database for PostgreSQL supports authentication with PostgreSQL logins and Entra ID authentication.

    By default, authentication with PostgreSQL logins is enabled. PostgreSQL logins are unable to provide sufficient protection for identities. -Azure AD authentication provides strong protection controls including conditional access, identity governance, and privileged identity management.

    -

    Once you decide to use Azure AD authentication, you can disable authentication with PostgreSQL logins.

    -

    Azure AD-only authentication is only supported for the flexible server deployment model.

    +Entra ID authentication provides strong protection controls including conditional access, identity governance, +and privileged identity management.

    +

    Once you decide to use Entra ID authentication, you can disable authentication with PostgreSQL logins.

    +

    Entra ID only authentication is only supported for the flexible server deployment model.

    Recommendation#

    -

    Consider using Azure AD-only authentication. -Also consider using Azure Policy for Azure AD-only authentication with Azure Database for PostgreSQL.

    +

    Consider using Entra ID only authentication. +Also consider using Azure Policy for Entra ID only authentication with Azure Database for PostgreSQL.

    Examples#

    Configure with Azure template#

    To deploy Azure Database for PostgreSQL flexible servers that pass this rule:

      -
    • Set the properties.authConfig.activeDirectoryAuth property to true.
      • -
    • Set the properties.authConfig.passwordAuth property to false.
      • +
    • Set the properties.authConfig.activeDirectoryAuth property to Enabled.
      • +
    • Set the properties.authConfig.passwordAuth property to Disabled.

    For example:

    Azure Template snippet
    {
   "type": "Microsoft.DBforPostgreSQL/flexibleServers",
   "apiVersion": "2022-12-01",
-  "name": "[parameters('serverName')]",
+  "name": "[parameters('name')]",
   "location": "[parameters('location')]",
-  "properties": {
-    "authConfig": {
-      "activeDirectoryAuth": "Enabled",
-      "passwordAuth": "Disabled",
-      "tenantId": "[parameters('tenantId')]"
-    }
-  }
-}
+  "sku": {
+    "name": "Standard_D2ds_v4",
+    "tier": "GeneralPurpose"
+  },
+  "properties": {
+    "createMode": "Default",
+    "authConfig": {
+      "activeDirectoryAuth": "Enabled",
+      "passwordAuth": "Disabled",
+      "tenantId": "[tenant().tenantId]"
+    },
+    "version": "14",
+    "storage": {
+      "storageSizeGB": 32
+    },
+    "backup": {
+      "backupRetentionDays": 7,
+      "geoRedundantBackup": "Enabled"
+    },
+    "highAvailability": {
+      "mode": "ZoneRedundant"
+    }
+  }
+}

    Configure with Bicep#

    To deploy Azure Database for PostgreSQL flexible servers that pass this rule:

      -
    • Set the properties.authConfig.activeDirectoryAuth property to true.
      • -
    • Set the properties.authConfig.passwordAuth property to false.
      • +
    • Set the properties.authConfig.activeDirectoryAuth property to Enabled.
      • +
    • Set the properties.authConfig.passwordAuth property to Disabled.

    For example:

    -
    Azure Bicep snippet
    resource postgreSqlFlexibleServer 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' = {
-  name: serverName
+
    Azure Bicep snippet
    resource flexible 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' = {
+  name: name
   location: location
-  properties: {
-    authConfig: {
-      activeDirectoryAuth: 'Enabled'
-      passwordAuth: 'Disabled'
-      tenantId: tenantId
-    }
-  }
-}
+  sku: {
+    name: 'Standard_D2ds_v4'
+    tier: 'GeneralPurpose'
+  }
+  properties: {
+    createMode: 'Default'
+    authConfig: {
+      activeDirectoryAuth: 'Enabled'
+      passwordAuth: 'Disabled'
+      tenantId: tenant().tenantId
+    }
+    version: '14'
+    storage: {
+      storageSizeGB: 32
+    }
+    backup: {
+      backupRetentionDays: 7
+      geoRedundantBackup: 'Enabled'
+    }
+    highAvailability: {
+      mode: 'ZoneRedundant'
+    }
+  }
+}
 
    
 
    Notes#
    
-
    The Azure AD admin must be set before enabling Azure AD-only authentication.
-Azure AD-only authentication is only suppored for the flexible server deployment model.
    
+
    The Entra ID admin must be set before enabling Entra ID only authentication.
+Entra ID only authentication is only supported for the flexible server deployment model.
    
 
 
@@ -13299,7 +13333,7 @@