Skip to content

Commit 6987fd6

Browse files
taoyangcloudtaoyangcloud
authored
Update Defender for Cloud CSPM DINE policy (#47)
* Disable AI model scanner in Defender for Cloud policy assignment * Add support for Serverless Containers feature in Defender for Cloud policies * Normalize allowed values for AKSD effects in Kubernetes policy initiative * Normalize allowed values for AKSD effects in policy initiative * Normalize allowed values for AKSD effects to use consistent casing * Remove "Deny" from allowed values for AKSD effect in policy initiative * Enable AI model scanner in Defender for Cloud policy assignment
1 parent 8b47afd commit 6987fd6

5 files changed

Lines changed: 56 additions & 18 deletions

File tree

‎policyAssignments/dev/pa-d-mdc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@
8585
"isAgentlessServerlessPostureEnabled": {
8686
"value": "true"
8787
},
88+
"isServerlessContainersEnabled":{
89+
"value": "true"
90+
},
8891
"isMdeDesignatedSubscriptionEnabled": {
8992
"value": "false"
9093
},

‎policyAssignments/prod/pa-p-mdc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@
8585
"isAgentlessServerlessPostureEnabled": {
8686
"value": "true"
8787
},
88+
"isServerlessContainersEnabled":{
89+
"value": "true"
90+
},
8891
"isMdeDesignatedSubscriptionEnabled": {
8992
"value": "false"
9093
},

‎policyDefinitions/mdc/pol-deploy-defender-cspm.json‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,18 @@
114114
"false"
115115
],
116116
"defaultValue": "true"
117+
},
118+
"isServerlessContainersEnabled": {
119+
"type": "string",
120+
"metadata": {
121+
"displayName": "Serverless Containers Enabled",
122+
"description": "Enable or disable the Serverless Containers add-on feature"
123+
},
124+
"allowedValues": [
125+
"true",
126+
"false"
127+
],
128+
"defaultValue": "true"
117129
}
118130
},
119131
"policyRule": {
@@ -246,11 +258,23 @@
246258
"equals": "[parameters('isAgentlessServerlessPostureEnabled')]"
247259
}
248260
]
261+
},
262+
{
263+
"allOf": [
264+
{
265+
"field": "Microsoft.Security/pricings/extensions[*].name",
266+
"equals": "ServerlessContainers"
267+
},
268+
{
269+
"field": "Microsoft.Security/pricings/extensions[*].isEnabled",
270+
"equals": "[parameters('isServerlessContainersEnabled')]"
271+
}
272+
]
249273
}
250274
]
251275
}
252276
},
253-
"equals": 3
277+
"equals": 4
254278
}
255279
]
256280
},
@@ -279,6 +303,9 @@
279303
},
280304
"isAgentlessServerlessPostureEnabled": {
281305
"value": "[parameters('isAgentlessServerlessPostureEnabled')]"
306+
},
307+
"isServerlessContainersEnabled": {
308+
"value": "[parameters('isServerlessContainersEnabled')]"
282309
}
283310
},
284311
"template": {
@@ -305,6 +332,9 @@
305332
},
306333
"isAgentlessServerlessPostureEnabled": {
307334
"type": "string"
335+
},
336+
"isServerlessContainersEnabled": {
337+
"type": "string"
308338
}
309339
},
310340
"variables": {},
@@ -343,6 +373,10 @@
343373
{
344374
"name": "AgentlessServerlessPosture",
345375
"isEnabled": "[parameters('isAgentlessServerlessPostureEnabled')]"
376+
},
377+
{
378+
"name": "ServerlessContainers",
379+
"isEnabled": "[parameters('isServerlessContainersEnabled')]"
346380
}
347381
]
348382
}

‎policyInitiatives/polset-aks-data.json‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,8 @@
1818
"portalReview": true
1919
},
2020
"allowedValues": [
21-
"audit",
2221
"Audit",
23-
"deny",
2422
"Deny",
25-
"disabled",
2623
"Disabled"
2724
],
2825
"defaultValue": "Deny"
@@ -1057,11 +1054,8 @@
10571054
"portalReview": true
10581055
},
10591056
"allowedValues": [
1060-
"audit",
10611057
"Audit",
1062-
"deny",
10631058
"Deny",
1064-
"disabled",
10651059
"Disabled"
10661060
],
10671061
"defaultValue": "Audit"
@@ -1859,11 +1853,8 @@
18591853
"portalReview": true
18601854
},
18611855
"allowedValues": [
1862-
"audit",
18631856
"Audit",
1864-
"deny",
18651857
"Deny",
1866-
"disabled",
18671858
"Disabled"
18681859
],
18691860
"defaultValue": "Audit"
@@ -1973,11 +1964,8 @@
19731964
"portalReview": true
19741965
},
19751966
"allowedValues": [
1976-
"audit",
19771967
"Audit",
1978-
"deny",
19791968
"Deny",
1980-
"disabled",
19811969
"Disabled"
19821970
],
19831971
"defaultValue": "Audit"
@@ -2224,11 +2212,8 @@
22242212
"portalReview": true
22252213
},
22262214
"allowedValues": [
2227-
"audit",
22282215
"Audit",
2229-
"deny",
22302216
"Deny",
2231-
"disabled",
22322217
"Disabled"
22332218
],
22342219
"defaultValue": "Audit"
@@ -2330,7 +2315,6 @@
23302315
},
23312316
"allowedValues": [
23322317
"Audit",
2333-
"Deny",
23342318
"Disabled"
23352319
],
23362320
"defaultValue": "Audit"

‎policyInitiatives/polset-mdc.json‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,18 @@
309309
],
310310
"defaultValue": "true"
311311
},
312-
312+
"isServerlessContainersEnabled": {
313+
"type": "String",
314+
"metadata": {
315+
"displayName": "Serverless Containers Enabled",
316+
"description": "Enable or disable the Serverless Containers add-on feature"
317+
},
318+
"allowedValues": [
319+
"true",
320+
"false"
321+
],
322+
"defaultValue": "true"
323+
},
313324
"isMdeDesignatedSubscriptionEnabled": {
314325
"type": "String",
315326
"metadata": {
@@ -572,6 +583,9 @@
572583
},
573584
"isAgentlessServerlessPostureEnabled": {
574585
"value": "[parameters('isAgentlessServerlessPostureEnabled')]"
586+
},
587+
"isServerlessContainersEnabled": {
588+
"value": "[parameters('isServerlessContainersEnabled')]"
575589
}
576590
},
577591
"groupNames": [

0 commit comments

Comments
 (0)