azure-policy/built-in-policies/policyDefinitions/Kubernetes/ASC_Azure_Defender_Arc_Extension_Audit.json at master · Azure/azure-policy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
{
  "properties": {
    "displayName": "[Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Microsoft Defender for Cloud extension for Azure Arc provides threat protection for your Arc enabled Kubernetes clusters. The extension collects data from all nodes in the cluster and sends it to the Azure Defender for Kubernetes backend in the cloud for further analysis. Learn more in https://un5n6892w35t1nyda79dnd8.subtlesoundimmersion.net/azure/defender-for-cloud/defender-for-containers-enable?pivots=defender-for-container-arc.",
    "metadata": {
      "version": "6.0.0-preview",
      "category": "Kubernetes",
      "preview": "true"
    },
    "version": "6.0.0-preview",
    "parameters": {
      "effect": {
        "type": "string",
        "defaultValue": "AuditIfNotExists",
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Kubernetes/connectedClusters"
          },
          {
            "field": "Microsoft.Kubernetes/connectedClusters/distribution",
            "notIn": [
              "aks",
              "aks_management",
              "eks",
              "gke"
            ]
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.KubernetesConfiguration/extensions",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.KubernetesConfiguration/extensions/extensionType",
                "equals": "microsoft.azuredefender.kubernetes"
              },
              {
                "field": "Microsoft.KubernetesConfiguration/extensions/provisioningState",
                "equals": "Succeeded"
              }
            ]
          }
        }
      }
    },
    "versions": [
      "6.0.0-PREVIEW"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/8dfab9c4-fe7b-49ad-85e4-1e9be085358f",
  "name": "8dfab9c4-fe7b-49ad-85e4-1e9be085358f"
}