Update Policy Library (automated)

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt

@@ -8,11 +8,21 @@ var varPolicyAssignmentAuditPeDnsZones = {
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_pednszones.tmpl.json')
 }
 
+var varPolicyAssignmentAuditLocationMatch = {
+	definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a'
+	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json')
+}
+
 var varPolicyAssignmentAuditUnusedResources = {
 	definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Audit-UnusedResourcesCostOptimization'
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json')
 }
 
+var varPolicyAssignmentAuditZoneResiliency = {
+	definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/130fb88f-0fc9-4678-bfe1-31022d71c7d5'
+	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json')
+}
+
 var varPolicyAssignmentDenyAppGWWithoutWAF = {
 	definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppGW-Without-WAF'
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_appgw_without_waf.tmpl.json')
@@ -248,12 +258,12 @@ var varPolicyAssignmentEnforceGRKeyVault = {
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json')
 }
 
-var varPolicyAssignmentEnforceSovereigntyConf = {
+var varPolicyAssignmentEnforceSovereignConf = {
 	definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/03de05a4-c324-4ccd-882f-a814ea8ab9ea'
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_conf.tmpl.json')
 }
 
-var varPolicyAssignmentEnforceSovereigntyGlobal = {
+var varPolicyAssignmentEnforceSovereignGlobal = {
 	definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/c1cbff38-87c0-4b9f-9f70-035c7a3b5523'
 	libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json')
 }

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json

@@ -0,0 +1,18 @@
+{
+  "name": "Audit-Location-Match",
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2019-09-01",
+  "properties": {
+    "description": "Audit resource location matches resource group location",
+    "displayName": "Audit that the resource location matches its resource group location",
+    "notScopes": [],
+    "parameters": {},
+    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a",
+    "scope": null,
+    "enforcementMode": "Default"
+  },
+  "location": null,
+  "identity": {
+    "type": "None"
+  }
+}

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json

@@ -0,0 +1,25 @@
+{
+  "name": "Audit-ZoneResiliency",
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2019-09-01",
+  "properties": {
+    "description": "Resources should be Zone Resilient.",
+    "displayName": "Resources should be Zone Resilient",
+    "notScopes": [],
+    "parameters": {
+      "effect": {
+        "value": "Audit"
+      },
+      "allow": {
+        "value": "Both"
+      }
+    },
+    "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/130fb88f-0fc9-4678-bfe1-31022d71c7d5",
+    "scope": null,
+    "enforcementMode": "Default"
+  },
+  "location": null,
+  "identity": {
+    "type": "None"
+  }
+}

infra-as-code/bicep/modules/policy/definitions/customPolicyDefinitions.bicep

@@ -457,6 +457,26 @@ var varCustomPolicyDefinitionsArray = [
     name: 'Deploy-FirewallPolicy'
     libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-FirewallPolicy.json')
   }
+  {
+    name: 'Deploy-MDFC-Arc-SQL-DCR-Association'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json')
+  }
+  {
+    name: 'Deploy-MDFC-Arc-Sql-DefenderSQL-DCR'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json')
+  }
+  {
+    name: 'Deploy-MDFC-SQL-AMA'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json')
+  }
+  {
+    name: 'Deploy-MDFC-SQL-DefenderSQL-DCR'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json')
+  }
+  {
+    name: 'Deploy-MDFC-SQL-DefenderSQL'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json')
+  }
   {
     name: 'Deploy-MySQL-sslEnforcement'
     libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MySQL-sslEnforcement.json')
@@ -505,6 +525,10 @@ var varCustomPolicyDefinitionsArray = [
     name: 'Deploy-Storage-sslEnforcement'
     libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Storage-sslEnforcement.json')
   }
+  {
+    name: 'Deploy-UserAssignedManagedIdentity-VMInsights'
+    libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json')
+  }
   {
     name: 'Deploy-Vm-autoShutdown'
     libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Vm-autoShutdown.json')
@@ -615,6 +639,12 @@ var varCustomPolicySetDefinitionsArray = [
         definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.BotServiceDenyPublicIP.parameters
         definitionGroups: []
       }
+      {
+        definitionReferenceId: 'ContainerAppsEnvironmentDenyPublicIP'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d074ddf8-01a5-4b5e-a2b8-964aed452c0a'
+        definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ContainerAppsEnvironmentDenyPublicIP.parameters
+        definitionGroups: []
+      }
       {
         definitionReferenceId: 'CosmosDenyPaasPublicIP'
         definitionId: '/providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a'
@@ -695,6 +725,36 @@ var varCustomPolicySetDefinitionsArray = [
       }
     ]
   }
+  {
+    name: 'Deploy-AUM-CheckUpdates'
+    libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-AUM-CheckUpdates.json')
+    libSetChildDefinitions: [
+      {
+        definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateLinux'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46'
+        definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateLinux.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateWindows'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46'
+        definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateWindows.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'azureUpdateManagerVmCheckUpdateLinux'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15'
+        definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateLinux.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'azureUpdateManagerVmCheckUpdateWindows'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15'
+        definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateWindows.parameters
+        definitionGroups: []
+      }
+    ]
+  }
   {
     name: 'Deploy-Diagnostics-LogAnalytics'
     libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json')
@@ -1227,6 +1287,12 @@ var varCustomPolicySetDefinitionsArray = [
         definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForVMVulnerabilityAssessment.parameters
         definitionGroups: []
       }
+      {
+        definitionReferenceId: 'migrateToMdeTvm'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.migrateToMdeTvm.parameters
+        definitionGroups: []
+      }
       {
         definitionReferenceId: 'securityEmailContact'
         definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts'
@@ -1235,6 +1301,54 @@ var varCustomPolicySetDefinitionsArray = [
       }
     ]
   }
+  {
+    name: 'Deploy-MDFC-DefenderSQL-AMA'
+    libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json')
+    libSetChildDefinitions: [
+      {
+        definitionReferenceId: 'defenderForSqlAma'
+        definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-AMA'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlAma.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlArcAma'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3592ff98-9787-443a-af59-4505d0fe0786'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcAma.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlArcDcrAssociation'
+        definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-SQL-DCR-Association'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcDcrAssociation.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlArcMdsql'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/65503269-6a54-4553-8a28-0065a8e6d929'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsql.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlArcMdsqlDcr'
+        definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-Sql-DefenderSQL-DCR'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsqlDcr.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlMdsql'
+        definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsql.parameters
+        definitionGroups: []
+      }
+      {
+        definitionReferenceId: 'defenderForSqlMdsqlDcr'
+        definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL-DCR'
+        definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsqlDcr.parameters
+        definitionGroups: []
+      }
+    ]
+  }
   {
     name: 'Deploy-Private-DNS-Zones'
     libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json')
@@ -1318,15 +1432,15 @@ var varCustomPolicySetDefinitionsArray = [
         definitionGroups: []
       }
       {
-        definitionReferenceId: 'DINE-Private-DNS-Azure-Databrics-Browser-AuthN'
+        definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-Browser-AuthN'
         definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c'
-        definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databrics-Browser-AuthN'].parameters
+        definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-Browser-AuthN'].parameters
         definitionGroups: []
       }
       {
-        definitionReferenceId: 'DINE-Private-DNS-Azure-Databrics-UI-Api'
+        definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-UI-Api'
         definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c'
-        definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databrics-UI-Api'].parameters
+        definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-UI-Api'].parameters
         definitionGroups: []
       }
       {
@@ -1761,6 +1875,12 @@ var varCustomPolicySetDefinitionsArray = [
         definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AppServiceminTlsVersion.parameters
         definitionGroups: []
       }
+      {
+        definitionReferenceId: 'ContainerAppsHttpsOnlyEffect'
+        definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb'
+        definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.ContainerAppsHttpsOnlyEffect.parameters
+        definitionGroups: []
+      }
       {
         definitionReferenceId: 'FunctionLatestTlsEffect'
         definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193'
@@ -1929,10 +2049,14 @@ var varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters = loadJsonContent(
 
 var varPolicySetDefinitionEsDenyActionDeleteProtectionParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_DenyAction-DeleteProtection.parameters.json')
 
+var varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-AUM-CheckUpdates.parameters.json')
+
 var varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.parameters.json')
 
 var varPolicySetDefinitionEsDeployMDFCConfigParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.parameters.json')
 
+var varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.parameters.json')
+
 var varPolicySetDefinitionEsDeployPrivateDNSZonesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json')
 
 var varPolicySetDefinitionEsDeploySqlSecurityParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.parameters.json')

infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/_policyDefinitionsBicepInput.txt

@@ -442,6 +442,26 @@
 	name: 'Deploy-FirewallPolicy'
 	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-FirewallPolicy.json')
 }
+{
+	name: 'Deploy-MDFC-Arc-SQL-DCR-Association'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json')
+}
+{
+	name: 'Deploy-MDFC-Arc-Sql-DefenderSQL-DCR'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json')
+}
+{
+	name: 'Deploy-MDFC-SQL-AMA'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json')
+}
+{
+	name: 'Deploy-MDFC-SQL-DefenderSQL-DCR'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json')
+}
+{
+	name: 'Deploy-MDFC-SQL-DefenderSQL'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json')
+}
 {
 	name: 'Deploy-MySQL-sslEnforcement'
 	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MySQL-sslEnforcement.json')
@@ -490,6 +510,10 @@
 	name: 'Deploy-Storage-sslEnforcement'
 	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Storage-sslEnforcement.json')
 }
+{
+	name: 'Deploy-UserAssignedManagedIdentity-VMInsights'
+	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json')
+}
 {
 	name: 'Deploy-Vm-autoShutdown'
 	libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Vm-autoShutdown.json')

infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MariaDB.json

@@ -6,12 +6,13 @@
   "properties": {
     "policyType": "Custom",
     "mode": "Indexed",
-    "displayName": "Deploy Diagnostic Settings for MariaDB to Log Analytics workspace",
-    "description": "Deploys the diagnostic settings for MariaDB to stream to a Log Analytics workspace when any MariaDB  which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled",
+    "displayName": "[Deprecated] Diagnostic Settings for MariaDB to Log Analytics Workspace",
+    "description": "Deploys the diagnostic settings for MariaDB to stream to a Log Analytics workspace when any MariaDB  which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled. Deprecating due to service retirement, https://learn.microsoft.com/en-us/azure/mariadb/whats-happening-to-mariadb",
     "metadata": {
-      "version": "1.1.0",
+      "version": "1.1.0-deprecated",
       "category": "Monitoring",
       "source": "https://github.com/Azure/Enterprise-Scale/",
+      "deprecated": true,
       "alzCloudEnvironments": [
         "AzureCloud",
         "AzureChinaCloud",