-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathassignments_org.tf
109 lines (95 loc) · 4.29 KB
/
assignments_org.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
##################
# General
##################
module "org_mg_whitelist_regions" {
source = "..//modules/def_assignment"
definition = module.whitelist_regions.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
assignment_parameters = {
"listOfRegionsAllowed" = [
"UK South",
"UK West",
"Global"
]
}
assignment_metadata = {
version = "1.0.0"
category = "Batch"
propertyA = "A"
propertyB = "B"
}
}
##################
# Security Center
##################
module "org_mg_configure_asc_initiative" {
source = "..//modules/set_assignment"
initiative = module.configure_asc_initiative.initiative
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "DeployIfNotExists"
skip_remediation = var.skip_remediation
skip_role_assignment = var.skip_role_assignment
role_assignment_scope = data.azurerm_management_group.team_a.id # using explicit scopes
role_definition_ids = [
data.azurerm_role_definition.contributor.id # using explicit roles
]
assignment_parameters = {
workspaceId = local.dummy_resource_ids.azurerm_log_analytics_workspace
eventHubDetails = local.dummy_resource_ids.azurerm_eventhub_namespace_authorization_rule
securityContactsEmail = "[email protected]"
securityContactsPhone = "44897654987"
}
}
##################
# Monitoring
##################
module "org_mg_platform_diagnostics_initiative" {
source = "..//modules/set_assignment"
initiative = module.platform_diagnostics_initiative.initiative
assignment_scope = data.azurerm_management_group.org.id
skip_remediation = true
skip_role_assignment = false
role_definition_ids = [
data.azurerm_role_definition.contributor.id # using explicit roles
]
non_compliance_messages = {
null = "The Default non-compliance message for all member definitions"
"DeployApplicationGatewayDiagnosticSetting" = "The non-compliance message for the deploy_application_gateway_diagnostic_setting definition"
}
assignment_parameters = {
workspaceId = local.dummy_resource_ids.azurerm_log_analytics_workspace
storageAccountId = local.dummy_resource_ids.azurerm_storage_account
eventHubName = local.dummy_resource_ids.azurerm_eventhub_namespace
eventHubAuthorizationRuleId = local.dummy_resource_ids.azurerm_eventhub_namespace_authorization_rule
metricsEnabled = "True"
logsEnabled = "True"
effect_DeployApplicationGatewayDiagnosticSetting = "DeployIfNotExists"
effect_DeployEventhubDiagnosticSetting = "DeployIfNotExists"
effect_DeployFirewallDiagnosticSetting = "DeployIfNotExists"
effect_DeployKeyvaultDiagnosticSetting = "AuditIfNotExists"
effect_DeployLoadbalancerDiagnosticSetting = "AuditIfNotExists"
effect_DeployNetworkInterfaceDiagnosticSetting = "AuditIfNotExists"
effect_DeployNetworkSecurityGroupDiagnosticSetting = "AuditIfNotExists"
effect_DeployPublicIpDiagnosticSetting = "AuditIfNotExists"
effect_DeployStorageAccountDiagnosticSetting = "DeployIfNotExists"
effect_DeploySubscriptionDiagnosticSetting = "DeployIfNotExists"
effect_DeployVnetDiagnosticSetting = "AuditIfNotExists"
effect_DeployVnetGatewayDiagnosticSetting = "AuditIfNotExists"
}
}
##################
# Storage
##################
module "org_mg_storage_enforce_https" {
source = "..//modules/def_assignment"
definition = module.storage_enforce_https.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
}
module "org_mg_storage_enforce_minimum_tls1_2" {
source = "..//modules/def_assignment"
definition = module.storage_enforce_minimum_tls1_2.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
}