HITRUST CSF 11.5 - Azure

This page lists all 87 policies in the HITRUST CSF 11.5 pack for Azure, as published in hitrust-azure version 2.2.1.

Policies by control

01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

• aks-azure-ad-integration
• custom-role-definition-least-privilege
• key-vault-access-policies
• keyvault-rbac-least-privilege
• sql-database-least-privilege
• sql-server-azure-ad-authentication
• web-app-auth-settings

01.c Privilege Management — The allocation and use of privileges shall be restricted and controlled. The use of privileged utility programs shall be restricted and tightly controlled.

• rbac-least-privilege

01.v Information Access Restriction — Access to systems and applications shall be restricted in accordance with the access control policy.

• storage-account-least-privilege

06.ad04.01 Data Retention and Disposal — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

• key-vault-purge-protection

06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

• aks-secret-encryption
• blob-service-lifecycle
• event-hubs-retention
• key-vault-soft-delete
• log-analytics-retention
• prohibit-hardcoded-secrets
• sql-database-tde-enabled
• storage-account-files-encryption
• vm-requires-managed-disks

07.a Inventory of Assets — All assets shall be accounted for and have a nominated owner.

• resources-cost-management-tags

09.ac10.01 Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

• api-management-tls

09.ac10.01 Encryption In Transit — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

• app-service-https-only
• application-gateway-tls

09.b Change Management — Changes to systems, applications and supporting infrastructure shall be controlled.

• resources-change-tracking-tags

09.d Separation of Development Test and Operational Environments — Development, testing and production environments shall be separated.

• resources-environment-tags

09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

• aks-network-policies
• aks-private-clusters
• app-service-disable-ftp
• application-gateway-waf
• cosmos-db-private-endpoints
• key-vault-network-access
• mysql-private-endpoints
• network-interface-no-public-ip
• nsg-disallow-public-internet-ingress
• nsg-http-restriction
• nsg-strict-rules
• postgresql-private-endpoints
• redis-cache-private-endpoints
• sql-server-disable-public-access
• sql-server-private-endpoints
• storage-account-firewall
• storage-account-public-access
• storage-account-public-network-access
• vm-scale-set-no-public-ip
• vnet-ddos-protection

09.z Publicly Available Information — Publicly available information shall be protected against unauthorized modification or deletion.

• flow-log-configuration
• sql-server-audit-logging

10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

• container-registry-customer-managed-keys
• cosmos-db-customer-managed-keys
• data-factory-customer-managed-keys
• event-hubs-customer-managed-keys
• front-door-tls
• function-app-customer-managed-keys
• key-vault-key-configuration
• key-vault-key-lifecycle
• key-vault-key-rotation
• key-vault-lifecycle
• managed-disk-customer-managed-keys
• mysql-customer-managed-keys
• mysql-ssl-enforcement
• nsg-ssh-rdp-restriction
• postgresql-customer-managed-keys
• postgresql-ssl-enforcement
• redis-cache-non-ssl-port
• service-bus-customer-managed-keys
• sql-database-customer-managed-keys
• sql-server-encrypted-connections
• storage-account-https-only
• storage-account-uses-customer-managed-keys
• synapse-workspace-customer-managed-keys
• vm-scale-set-require-managed-disks

10.h Control of Operational Software — The installation of software on operational systems shall be controlled.

• custom-image-validation
• vm-approved-images

10.k Change Control Procedures — Changes to systems within the development lifecycle shall be controlled by the use of formal change control procedures.

• aks-auto-upgrade
• vm-scale-set-automatic-os-upgrades

10.m Control of Technical Vulnerabilities — Information about technical vulnerabilities of information systems being used shall be obtained in a timely fashion, the organization’s exposure to such vulnerabilities evaluated and appropriate measures taken to address the associated risk.

• azure-firewall-threat-intelligence

12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

• aks-node-pools-vm-scale-sets
• application-gateway-has-health-probes
• application-gateway-multi-az
• cosmos-db-backup-policies
• load-balancer-health-probes
• load-balancer-multi-az
• service-bus-dead-letter-queue
• sql-database-backup-retention
• sql-database-high-availability
• storage-account-geo-replication
• vm-scale-set-multi-az

Policy details

aks-auto-upgrade

Severity: high · Enforcement: advisory

Require AKS clusters to have auto-upgrade enabled

• 10.k Change Control Procedures — Changes to systems within the development lifecycle shall be controlled by the use of formal change control procedures.

const aksCluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    dnsPrefix: "myaks",
    autoUpgradeProfile: {
        upgradeChannel: "stable",       // Set to 'stable', 'patch', or 'rapid'
        nodeOSUpgradeChannel: "NodeImage",  // Enable node OS auto-upgrade
    },
    // ... other config
});

aks-azure-ad-integration

Severity: high · Enforcement: advisory

Require AKS clusters to use Azure AD integration

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const cluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    enableRBAC: true,  // Required for Azure AD
    aadProfile: {
        managed: true,  // Enable managed Azure AD integration
        enableAzureRBAC: true,  // Optional: Azure RBAC for Kubernetes
    },
    disableLocalAccounts: true,  // Disable local accounts for enhanced security
    // ... other config
});

aks-network-policies

Severity: high · Enforcement: advisory

Require AKS clusters to have network policies enabled

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const cluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    networkProfile: {
        networkPlugin: "azure",  // Azure CNI recommended
        networkPolicy: "calico",  // Enable network policy (calico, azure, or cilium)
    },
    // ... other config
});

aks-node-pools-vm-scale-sets

Severity: high · Enforcement: advisory

Require AKS node pools to use VM Scale Sets

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const cluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    agentPoolProfiles: [{
        name: "nodepool1",
        vmSize: "Standard_DS2_v2",
        type: "VirtualMachineScaleSets",  // Use VM Scale Sets for availability
        // ... other config
    }],
    // ... other config
});

aks-private-clusters

Severity: high · Enforcement: advisory

Require AKS clusters to be private clusters

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const aksCluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    apiServerAccessProfile: {
        enablePrivateCluster: true,  // Enable private cluster mode
        privateDNSZone: "system",  // Use system-managed private DNS zone
        enablePrivateClusterPublicFQDN: false,  // Disable public FQDN
    },
    // ... other config
});

aks-secret-encryption

Severity: high · Enforcement: advisory

Require AKS clusters to have secret encryption enabled

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const cluster = new azurenative.containerservice.ManagedCluster("my-aks-cluster", {
    addonProfiles: {
        azureKeyvaultSecretsProvider: {
            enabled: true,  // Enable Azure Key Vault Secrets Provider
            config: {
                enableSecretRotation: "true",  // Enable secret rotation
                rotationPollInterval: "2m",  // Set rotation interval
            },
        },
    },
    // ... other config
});

api-management-tls

Severity: high · Enforcement: advisory

Require API Management to have secure TLS/SSL configuration

• 09.ac10.01 Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const apiManagementService = new azurenative.apimanagement.ApiManagementService("my-api-mgmt", {
    customProperties: {
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": "false",  // Disable TLS 1.0
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": "false",  // Disable TLS 1.1
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": "false",  // Disable backend TLS 1.0
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11": "false",  // Disable backend TLS 1.1
    },
    // ... other config
});

app-service-disable-ftp

Severity: medium · Enforcement: advisory

Require App Service to block insecure FTP access

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const webApp = new azurenative.web.WebApp("mywebapp", {
    siteConfig: {
        ftpsState: "Disabled",  // Disable FTP access (or use "FtpsOnly" for encrypted FTP)
    },
    // ... other config
});

app-service-https-only

Severity: high · Enforcement: advisory

Require App Service to enforce HTTPS only connections

• 09.ac10.01 Encryption In Transit — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const webApp = new azurenative.web.WebApp("mywebapp", {
    httpsOnly: true,  // Redirect all HTTP traffic to HTTPS
    siteConfig: {
        minTlsVersion: "1.2",  // Set minimum TLS version
    },
    // ... other config
});

application-gateway-has-health-probes

Severity: medium · Enforcement: advisory

Require Application Gateway to enable health probes

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    probes: [{
        name: "health-probe",
        protocol: "Https",
        path: "/health",
        interval: 30,
        timeout: 30,
        unhealthyThreshold: 3,
        match: {
            statusCodes: ["200-399"],
        },
    }],
    backendHttpSettingsCollection: [{
        name: "backend-settings",
        probe: { id: healthProbe.id },  // Associate probe with backend settings
        // ... other config
    }],
    // ... other config
});

application-gateway-multi-az

Severity: medium · Enforcement: advisory

Require Application Gateway to be configured across multiple availability zones

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    zones: ["1", "2", "3"],  // Deploy across at least 2 availability zones
    // ... other config
});

application-gateway-tls

Severity: high · Enforcement: advisory

Require Application Gateway to have secure TLS configuration

• 09.ac10.01 Encryption In Transit — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    sslPolicy: {
        policyType: "Predefined",
        policyName: "AppGwSslPolicy20220101",  // Use modern policy with TLS 1.2+
    },
    // ... other config
});

application-gateway-waf

Severity: high · Enforcement: advisory

Require Application Gateway to have Web Application Firewall enabled

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    sku: {
        name: "WAF_v2",
        tier: "WAF_v2",  // Use WAF-enabled SKU
    },
    webApplicationFirewallConfiguration: {
        enabled: true,  // Enable WAF protection
        firewallMode: "Prevention",  // Block threats
        ruleSetType: "OWASP",
        ruleSetVersion: "3.2",
    },
    // ... other config
});

azure-firewall-threat-intelligence

Severity: high · Enforcement: advisory

Require Azure Firewall to have threat intelligence enabled

• 10.m Control of Technical Vulnerabilities — Information about technical vulnerabilities of information systems being used shall be obtained in a timely fashion, the organization’s exposure to such vulnerabilities evaluated and appropriate measures taken to address the associated risk.

const azureFirewall = new azurenative.network.AzureFirewall("my-firewall", {
    sku: { tier: "Standard" },
    threatIntelMode: "Deny",  // Set to "Deny" to block malicious traffic
    // ... other config
});

blob-service-lifecycle

Severity: medium · Enforcement: advisory

Require BlobServiceProperties to have versioning, change feed, and retention policies enabled

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const blobService = new azurenative.storage.BlobServiceProperties("default", {
    isVersioningEnabled: true,  // Enable versioning
    changeFeed: { enabled: true },  // Enable change feed
    deleteRetentionPolicy: { enabled: true, days: 7 },  // Enable delete retention
    // ... other config
});

container-registry-customer-managed-keys

Severity: high · Enforcement: advisory

Require Container Registry to use customer-managed keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const registry = new azurenative.containerregistry.Registry("my-registry", {
    sku: { name: "Premium" },  // Premium SKU required for customer-managed keys
    encryption: {
        status: "enabled",
        keyVaultProperties: {
            keyIdentifier: key.keyUri,  // Key Vault key URI
            identity: registryIdentity.id,  // User-assigned identity with Key Vault access
        },
    },
    // ... other config
});

cosmos-db-backup-policies

Severity: medium · Enforcement: advisory

Require Cosmos DB account to have backup policies configured

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

// Option 1: Continuous Backup (recommended)
const cosmosDbContinuous = new azurenative.cosmosdb.DatabaseAccount("my-cosmosdb", {
    databaseAccountOfferType: "Standard",
    backupPolicy: {
        type: "Continuous",  // Enable continuous backup
        continuousModeProperties: {
            tier: "Continuous30Days",  // 30-day point-in-time restore
        },
    },
    // ... other config
});

// Option 2: Periodic Backup
const cosmosDbPeriodic = new azurenative.cosmosdb.DatabaseAccount("my-cosmosdb", {
    databaseAccountOfferType: "Standard",
    backupPolicy: {
        type: "Periodic",  // Enable periodic backup
        periodicModeProperties: {
            backupIntervalInMinutes: 240,  // 4 hours
            backupRetentionIntervalInHours: 720,  // 30 days
        },
    },
    // ... other config
});

cosmos-db-customer-managed-keys

Severity: high · Enforcement: advisory

Require Cosmos DB to use customer-managed keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const cosmosAccount = new azurenative.cosmosdb.DatabaseAccount("my-cosmos-account", {
    databaseAccountOfferType: "Standard",
    keyVaultKeyUri: key.keyUriWithVersion,  // Reference Key Vault key for encryption
    identity: {
        type: "UserAssigned",  // Use managed identity
        userAssignedIdentities: { [identity.id]: {} },
    },
    defaultIdentity: pulumi.interpolate`UserAssignedIdentity=${identity.id}`,
    // ... other config
});

cosmos-db-private-endpoints

Severity: high · Enforcement: advisory

Require Cosmos DB account to have public network access disabled (indicating private endpoint usage)

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const cosmosAccount = new azurenative.cosmosdb.DatabaseAccount("my-cosmos-account", {
    databaseAccountOfferType: "Standard",
    publicNetworkAccess: "Disabled",  // Disable public access to enforce private endpoints
    // ... other config
});

custom-image-validation

Severity: medium · Enforcement: advisory

Validate custom managed images meet governance and security requirements

• 10.h Control of Operational Software — The installation of software on operational systems shall be controlled.

const customImage = new azurenative.compute.Image("my-custom-image", {
    tags: {
        "approved-by": "security-team@example.com",
        "creation-date": "2025-01-07",  // YYYY-MM-DD format
        "source-image": "Canonical:UbuntuServer:20.04-LTS",
        "vulnerability-scan-passed": "true",  // Must be 'true', 'yes', or 'passed'
        "hardening-applied": "true",  // Must be 'true', 'yes', or 'applied'
    },
    // ... other config
});

custom-role-definition-least-privilege

Severity: high · Enforcement: advisory

Ensure custom role definitions follow least privilege principles

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const customRole = new azurenative.authorization.RoleDefinition("my-role", {
    properties: {
        permissions: [{
            actions: [
                "Microsoft.Compute/virtualMachines/read",
                "Microsoft.Compute/virtualMachines/start/action",
                // Specify exact actions instead of "*"
            ],
            dataActions: [
                "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
                // Specify exact data actions instead of "*"
            ],
        }],
        assignableScopes: [
            "/subscriptions/{sub-id}/resourceGroups/my-rg",
            // Scope to resource groups instead of root or management groups
        ],
    },
    // ... other config
});

data-factory-customer-managed-keys

Severity: high · Enforcement: advisory

Require Data Factory to use customer-managed keys for encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const factory = new azurenative.datafactory.Factory("my-data-factory", {
    encryption: {
        keyName: key.name,  // Reference Key Vault key
        vaultBaseUrl: pulumi.interpolate`https://${keyVault.name}.vault.azure.net/`,
        keyVersion: key.version,  // Optional: specify key version
    },
    // ... other config
});

event-hubs-customer-managed-keys

Severity: high · Enforcement: advisory

Require Event Hub namespace to use customer-managed keys for encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const namespace = new azurenative.eventhub.Namespace("my-eventhub-namespace", {
    sku: {
        tier: "Premium",  // Customer-managed keys require Premium or Dedicated tier
    },
    encryption: {
        keySource: "Microsoft.KeyVault",  // Use Key Vault for customer-managed keys
        keyVaultProperties: [{
            keyName: "eventhub-encryption-key",
            keyVaultUri: keyVault.properties.vaultUri,
            identity: {
                userAssignedIdentity: identity.id,
            },
        }],
    },
    // ... other config
});

event-hubs-retention

Severity: medium · Enforcement: advisory

Require Event Hubs to have proper retention policies configured

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const eventHub = new azurenative.eventhub.EventHub("my-eventhub", {
    namespaceName: namespace.name,
    messageRetentionInDays: 7,  // Set retention period (1-7 days for Standard, up to 90 days for Premium)
    // ... other config
});

flow-log-configuration

Severity: medium · Enforcement: advisory

Require proper Flow Log configuration for network monitoring

• 09.z Publicly Available Information — Publicly available information shall be protected against unauthorized modification or deletion.

const flowLog = new azurenative.network.FlowLog("my-flowlog", {
    retentionPolicy: {
        enabled: true,
        days: 90,  // Set retention period (minimum 30 days)
    },
    format: {
        version: 2,  // Use version 2 for enhanced data
    },
    // ... other config
});

front-door-tls

Severity: high · Enforcement: advisory

Require Front Door custom domains to use secure TLS configuration

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const customDomain = new azurenative.cdn.AFDCustomDomain("my-custom-domain", {
    tlsSettings: {
        minimumTlsVersion: "TLS12",  // Enforce minimum TLS 1.2
        certificateType: "ManagedCertificate",  // Use Azure-managed certificates
    },
    // ... other config
});

function-app-customer-managed-keys

Severity: high · Enforcement: advisory

Require Function Apps to use customer-managed keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const functionApp = new azurenative.web.WebApp("myfunctionapp", {
    kind: "functionapp",
    identity: {
        type: "UserAssigned",  // Or "SystemAssigned"
        userAssignedIdentities: {
            [managedIdentity.id]: {},
        },
    },
    keyVaultReferenceIdentity: managedIdentity.id,  // Enable Key Vault integration
    // ... other config
});

key-vault-access-policies

Severity: high · Enforcement: advisory

Require proper access controls for Key Vault access policies

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const keyVault = new azurenative.keyvault.Vault("my-keyvault", {
    properties: {
        sku: { name: "standard" },
        accessPolicies: [{
            tenantId: tenantId,
            objectId: servicePrincipalId,
            permissions: {
                keys: ["get", "list", "encrypt", "decrypt"],  // Specific permissions instead of "all"
                secrets: ["get", "list"],  // Specific permissions instead of "all"
            },
        }],
    },
    // ... other config
});

key-vault-key-configuration

Severity: high · Enforcement: advisory

Require proper Key Vault key creation and configuration

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",  // or "RSA-HSM" for hardware protection
        keySize: 2048,  // Minimum 2048 bits for RSA
        keyOps: ["encrypt", "decrypt"],  // Specify exact operations needed
        attributes: {
            exportable: false,
        },
    },
    // ... other config
});

key-vault-key-lifecycle

Severity: high · Enforcement: advisory

Require proper Key Vault key deletion and lifecycle management

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",
        attributes: {
            exp: 1735689600,  // Set expiration date (Unix epoch timestamp)
            nbf: 1704067200,  // Set not-before date (Unix epoch timestamp)
        },
        // ... other config
    },
});

key-vault-key-rotation

Severity: high · Enforcement: advisory

Require Key Vault keys to have rotation policies configured

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",
        rotationPolicy: {
            attributes: {
                expiryTime: "P2Y",  // Set expiry time for key versions
            },
            lifetimeActions: [{
                action: { type: "rotate" },
                trigger: { timeAfterCreate: "P90D" },  // Rotate 90 days after creation
            }],
        },
        // ... other config
    },
});

key-vault-lifecycle

Severity: high · Enforcement: advisory

Require proper Key Vault deletion protection and lifecycle management

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const vault = new azurenative.keyvault.Vault("my-key-vault", {
    properties: {
        sku: { name: "standard" },
        enableSoftDelete: true,  // Enable soft delete
        softDeleteRetentionInDays: 90,  // Set retention period
        enablePurgeProtection: true,  // Enable purge protection
        // ... other config
    },
});

key-vault-network-access

Severity: high · Enforcement: advisory

Require Key Vault to have network access controls configured

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const vault = new azurenative.keyvault.Vault("my-key-vault", {
    properties: {
        sku: { name: "standard" },
        networkAcls: {
            defaultAction: "Deny",  // Set default action to Deny
            bypass: "AzureServices",
            // ... other config
        },
        // ... other config
    },
});

key-vault-purge-protection

Severity: high · Enforcement: advisory

Require Key Vault to have purge protection enabled

• 06.ad04.01 Data Retention and Disposal — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const vault = new azurenative.keyvault.Vault("my-key-vault", {
    properties: {
        sku: { name: "standard" },
        enablePurgeProtection: true,  // Enable purge protection
        // ... other config
    },
});

key-vault-soft-delete

Severity: high · Enforcement: advisory

Require Key Vault to have soft delete enabled with appropriate retention

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const vault = new azurenative.keyvault.Vault("my-key-vault", {
    properties: {
        sku: { name: "standard" },
        enableSoftDelete: true,  // Enable soft delete
        softDeleteRetentionInDays: 90,  // Set retention period (minimum 90 days)
        // ... other config
    },
});

keyvault-rbac-least-privilege

Severity: high · Enforcement: advisory

Ensure Key Vaults using RBAC use appropriate Key Vault-specific roles instead of broad management roles

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const keyVault = new azurenative.keyvault.Vault("my-keyvault", {
    properties: {
        sku: { name: "standard" },
        enableRbacAuthorization: true,  // Enable RBAC for better access control
        accessPolicies: [],
    },
    // ... other config
});

load-balancer-health-probes

Severity: medium · Enforcement: advisory

Require Load Balancer to enable health probes

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const loadBalancer = new azurenative.network.LoadBalancer("my-load-balancer", {
    sku: { name: "Standard" },
    probes: [{
        name: "http-health-probe",
        properties: {
            protocol: "Http",
            port: 80,
            requestPath: "/health",  // Configure health check endpoint
        },
    }],
    loadBalancingRules: [{
        name: "http-rule",
        properties: {
            probe: { id: probeId },  // Associate probe with rule
            // ... other config
        },
    }],
});

load-balancer-multi-az

Severity: medium · Enforcement: advisory

Require Load Balancer to be configured across multiple availability zones

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const loadBalancer = new azurenative.network.LoadBalancer("my-lb", {
    sku: {
        name: "Standard",  // Standard SKU required for zone redundancy
    },
    frontendIPConfigurations: [{
        zones: ["1", "2", "3"],  // Deploy across multiple zones
        // ... other config
    }],
});

log-analytics-retention

Severity: medium · Enforcement: advisory

Require Log Analytics workspace to have appropriate retention policies

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const workspace = new azurenative.operationalinsights.Workspace("my-workspace", {
    sku: {
        name: "PerGB2018",
    },
    retentionInDays: 90,  // Set to meet compliance requirements (minimum 90 days)
    // ... other config
});

managed-disk-customer-managed-keys

Severity: high · Enforcement: advisory

Require managed disks to use customer-managed encryption keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const disk = new azurenative.compute.Disk("my-disk", {
    sku: { name: "Premium_LRS" },
    diskSizeGB: 128,
    creationData: { createOption: "Empty" },
    encryption: {
        type: "EncryptionAtRestWithCustomerKey",  // Use customer-managed key
        diskEncryptionSetId: diskEncryptionSet.id,  // Reference to Disk Encryption Set
    },
    // ... other config
});

mysql-customer-managed-keys

Severity: high · Enforcement: advisory

Require MySQL flexible servers to use customer-managed keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const mysqlServer = new azurenative.dbformysql.Server("my-mysql-server", {
    sku: {
        tier: "GeneralPurpose",
    },
    dataEncryption: {
        type: "AzureKeyVault",  // Use customer-managed keys from Key Vault
        primaryKeyURI: key.keyUri,
        primaryUserAssignedIdentityId: identity.id,
    },
    // ... other config
});

mysql-private-endpoints

Severity: high · Enforcement: advisory

Require MySQL databases to use private endpoints

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const mysqlServer = new azurenative.dbformysql.Server("my-mysql-server", {
    sku: {
        tier: "GeneralPurpose",
    },
    network: {
        publicNetworkAccess: "Disabled",  // Disable public network access
    },
    // ... other config
});

mysql-ssl-enforcement

Severity: high · Enforcement: advisory

Require MySQL databases to have SSL enforcement enabled

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const requireSecureTransport = new azurenative.dbformysql.Configuration("require-secure-transport", {
    serverName: mysqlServer.name,
    configurationName: "require_secure_transport",
    value: "ON",  // Require SSL/TLS for all connections
    // ... other config
});

network-interface-no-public-ip

Severity: critical · Enforcement: advisory

Require Network Interfaces to have no public IP address associations

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const nic = new azurenative.network.NetworkInterface("my-nic", {
    ipConfigurations: [{
        privateIPAllocationMethod: "Dynamic",
        // Do NOT include publicIPAddress property
        // ... other config
    }],
});

nsg-disallow-public-internet-ingress

Severity: high · Enforcement: advisory

Require Network Security Groups to disallow public internet ingress

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const nsg = new azurenative.network.NetworkSecurityGroup("secure-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            sourceAddressPrefix: "203.0.113.0/24",  // Use specific IP ranges, not 0.0.0.0/0
            access: "Allow",
            direction: "Inbound",
            // ... other config
        },
    ],
});

nsg-http-restriction

Severity: high · Enforcement: advisory

Require Network Security Groups to disallow inbound HTTP traffic

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const nsg = new azurenative.network.NetworkSecurityGroup("my-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            destinationPortRange: "80",
            access: "Deny",  // Deny HTTP traffic
            direction: "Inbound",
            // ... other config
        },
        {
            protocol: "Tcp",
            destinationPortRange: "443",
            access: "Allow",  // Allow HTTPS instead
            direction: "Inbound",
            // ... other config
        },
    ],
});

nsg-ssh-rdp-restriction

Severity: high · Enforcement: advisory

Require Network Security Groups to restrict SSH and RDP access

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const nsg = new azurenative.network.NetworkSecurityGroup("secure-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            destinationPortRange: "22",
            sourceAddressPrefix: "10.0.255.0/24",  // Restrict to Bastion subnet, not 0.0.0.0/0
            access: "Allow",
            direction: "Inbound",
            // ... other config
        },
    ],
});

nsg-strict-rules

Severity: high · Enforcement: advisory

Require strict Network Security Group rules with explicit allow/deny configuration

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const nsg = new azurenative.network.NetworkSecurityGroup("strict-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            sourceAddressPrefix: "10.0.0.0/16",  // Use specific IP ranges, not * or 0.0.0.0/0
            destinationAddressPrefix: "10.0.1.0/24",  // Use specific destinations
            access: "Allow",
            direction: "Inbound",
            // ... other config
        },
    ],
});

postgresql-customer-managed-keys

Severity: high · Enforcement: advisory

Require PostgreSQL flexible servers to use customer-managed keys

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const server = new azurenative.dbforpostgresql.Server("my-postgres-server", {
    sku: {
        tier: "GeneralPurpose",
    },
    dataEncryption: {
        type: "AzureKeyVault",  // Use customer-managed keys from Key Vault
        primaryKeyUri: key.keyUriWithVersion,
        primaryUserAssignedIdentityId: identity.id,
    },
    // ... other config
});

postgresql-private-endpoints

Severity: high · Enforcement: advisory

Require PostgreSQL databases to use private endpoints

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const server = new azurenative.dbforpostgresql.Server("my-postgres-server", {
    sku: {
        tier: "GeneralPurpose",
    },
    network: {
        publicNetworkAccess: "Disabled",  // Disable public network access
    },
    // ... other config
});

postgresql-ssl-enforcement

Severity: high · Enforcement: advisory

Require PostgreSQL databases to have SSL enforcement enabled

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const requireSecureTransport = new azurenative.dbforpostgresql.Configuration("require-secure-transport", {
    serverName: server.name,
    configurationName: "require_secure_transport",
    value: "ON",  // Require SSL/TLS for all connections
    // ... other config
});

prohibit-hardcoded-secrets

Severity: critical · Enforcement: advisory

Prohibit hardcoded secrets in code and configuration

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const webApp = new azurenative.web.WebApp("my-app", {
    siteConfig: {
        appSettings: [
            {
                name: "DATABASE_PASSWORD",
                value: "mySecretPassword123",  // Hardcoded secret
            },
            {
                name: "API_KEY",
                value: "sk_live_abc123def456789",  // Hardcoded secret
            },
        ],
    },
});

const containerGroup = new azurenative.containerinstance.ContainerGroup("my-container", {
    containers: [{
        name: "app",
        environmentVariables: [
            {
                name: "DATABASE_PASSWORD",
                value: "mySecretPassword123",  // Hardcoded secret
            },
            {
                name: "API_TOKEN",
                value: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",  // Hardcoded JWT token
            },
        ],
    }],
});

const webApp = new azurenative.web.WebApp("my-app", {
    siteConfig: {
        connectionStrings: [{
            name: "DefaultConnection",
            connectionString: "Server=myserver;Database=mydb;User=admin;Password=hardcodedPassword123",
        }],
    },
});

rbac-least-privilege

Severity: critical · Enforcement: advisory

Enforce least privilege access control by prohibiting overly broad RBAC role assignments

• 01.c Privilege Management — The allocation and use of privileges shall be restricted and controlled. The use of privileged utility programs shall be restricted and tightly controlled.

const roleAssignment = new azurenative.authorization.RoleAssignment("my-assignment", {
    roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",  // Reader role instead of Owner/Contributor
    principalId: servicePrincipalId,
    scope: "/subscriptions/{sub-id}/resourceGroups/my-rg",  // Scope to resource group instead of subscription
});

redis-cache-non-ssl-port

Severity: high · Enforcement: advisory

Require Redis Cache to disable non-SSL port access

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const redisCache = new azurenative.redis.Redis("my-redis-cache", {
    enableNonSslPort: false,  // Disable non-SSL port to enforce encrypted connections
    minimumTlsVersion: "1.2",  // Enforce minimum TLS 1.2
    // ... other config
});

redis-cache-private-endpoints

Severity: high · Enforcement: advisory

Require Redis Cache to use private endpoints

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const redisCache = new azurenative.redis.Redis("my-redis-cache", {
    sku: {
        name: "Premium",  // Premium SKU required for private endpoints
        family: "P",
    },
    publicNetworkAccess: "Disabled",  // Disable public access
    subnetId: subnet.id,  // Deploy in subnet for network isolation
    minimumTlsVersion: "1.2",
    // ... other config
});

resources-change-tracking-tags

Severity: low · Enforcement: advisory

Require all Azure resources to have proper tagging for change tracking

• 09.b Change Management — Changes to systems, applications and supporting infrastructure shall be controlled.

const storageAccount = new azurenative.storage.StorageAccount("app-storage", {
    sku: {
        name: "Standard_LRS",
    },
    tags: {
        "last-modified": "2025-10-07",  // ISO 8601 date format (YYYY-MM-DD)
        "modified-by": "jane.doe@company.com",
        "change-reason": "Added storage account for new application deployment",
    },
    // ... other config
});

resources-cost-management-tags

Severity: low · Enforcement: advisory

Require all resources to have cost management tags

• 07.a Inventory of Assets — All assets shall be accounted for and have a nominated owner.

const resource = new azurenative.web.WebApp("my-app", {
    tags: {
        "cost-center": "CC-12345",
        project: "my-project",
        owner: "team@company.com",
        team: "engineering",
    },
    // ... other config
});

resources-environment-tags

Severity: low · Enforcement: advisory

Require all resources to have environment tags

• 09.d Separation of Development Test and Operational Environments — Development, testing and production environments shall be separated.

const resource = new azurenative.storage.StorageAccount("my-storage", {
    tags: {
        environment: "prod",  // Use "dev", "test", "staging", or "prod"
    },
    // ... other config
});

service-bus-customer-managed-keys

Severity: high · Enforcement: advisory

Require Service Bus namespace to use customer-managed keys for encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const namespace = new azurenative.servicebus.Namespace("my-namespace", {
    sku: {
        name: "Premium",  // Premium tier required for customer-managed keys
        tier: "Premium",
    },
    encryption: {
        keySource: "Microsoft.KeyVault",  // Use Azure Key Vault for encryption keys
        keyVaultProperties: [{
            keyName: key.name,
            keyVaultUri: keyVault.properties.vaultUri,
            identity: {
                userAssignedIdentity: identity.id,
            },
        }],
    },
    // ... other config
});

service-bus-dead-letter-queue

Severity: medium · Enforcement: advisory

Validate Service Bus queues have proper dead letter queue configuration

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const queue = new azurenative.servicebus.Queue("my-queue", {
    maxDeliveryCount: 10,  // Maximum delivery attempts before dead lettering
    deadLetteringOnMessageExpiration: true,  // Enable dead lettering when messages expire
    // ... other config
});

sql-database-backup-retention

Severity: medium · Enforcement: advisory

Require Azure SQL Database to have backup retention configured with redundant storage

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const database = new azurenative.sql.Database("my-database", {
    sku: {
        name: "S0",
        tier: "Standard",
    },
    requestedBackupStorageRedundancy: "Geo",  // Use geo-redundant backup storage
    // ... other config
});

sql-database-customer-managed-keys

Severity: high · Enforcement: advisory

Require Azure SQL databases to use customer-managed keys for transparent data encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const encryptionProtector = new azurenative.sql.EncryptionProtector("tde-protector", {
    serverKeyType: "AzureKeyVault",  // Use customer-managed key from Azure Key Vault
    serverKeyName: serverKey.name,
    autoRotationEnabled: true,  // Enable auto-rotation when key version changes
    // ... other config
});

sql-database-high-availability

Severity: medium · Enforcement: advisory

Require Azure SQL Database to have high availability configuration

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const database = new azurenative.sql.Database("my-database", {
    sku: {
        name: "P1",
        tier: "Premium",
    },
    zoneRedundant: true,  // Enable zone redundancy for high availability
    // ... other config
});

sql-database-least-privilege

Severity: high · Enforcement: advisory

Ensure SQL databases use appropriate SQL-specific roles instead of broad management roles

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const sqlAssignment = new azurenative.authorization.RoleAssignment("sql-access", {
    roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/9b7fa17d-e63e-47b0-bb0a-15c516ac86ec",  // SQL DB Contributor
    principalId: appServicePrincipalId,
    scope: "/subscriptions/{sub-id}/resourceGroups/my-rg/providers/Microsoft.Sql/servers/myserver/databases/mydb",
    // ... other config
});

sql-database-tde-enabled

Severity: high · Enforcement: advisory

Require Azure SQL databases to have Transparent Data Encryption (TDE) enabled

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const tde = new azurenative.sql.TransparentDataEncryption("my-database-tde", {
    state: "Enabled",  // Enable TDE for database encryption at rest
    // ... other config
});

sql-server-audit-logging

Severity: medium · Enforcement: advisory

Require Azure SQL Server to have audit logging enabled

• 09.z Publicly Available Information — Publicly available information shall be protected against unauthorized modification or deletion.

const auditPolicy = new azurenative.sql.ServerBlobAuditingPolicy("audit-policy", {
    state: "Enabled",  // Enable audit logging
    storageEndpoint: storageEndpoint,
    retentionDays: 90,  // Retain audit logs for 90 days
    // ... other config
});

sql-server-azure-ad-authentication

Severity: high · Enforcement: advisory

Require Azure SQL Server to have Azure AD administrators configured

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const sqlServer = new azurenative.sql.Server("my-sql-server", {
    administrators: {
        administratorType: "ActiveDirectory",
        login: "admin@contoso.com",  // Azure AD admin user or group name
        sid: "00000000-0000-0000-0000-000000000000",  // Azure AD object ID
        tenantId: "00000000-0000-0000-0000-000000000000",
        principalType: "User",
    },
    // ... other config
});

sql-server-disable-public-access

Severity: critical · Enforcement: advisory

Require Azure SQL Server to disable public network access

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const sqlServer = new azurenative.sql.Server("my-sql-server", {
    publicNetworkAccess: "Disabled",  // Disable public network access
    // ... other config
});

sql-server-encrypted-connections

Severity: high · Enforcement: advisory

Require Azure SQL Server to have encrypted connections with minimum TLS 1.2

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const sqlServer = new azurenative.sql.Server("my-sql-server", {
    minimalTlsVersion: "1.2",  // Enforce TLS 1.2 or higher for encrypted connections
    // ... other config
});

sql-server-private-endpoints

Severity: high · Enforcement: advisory

Require Azure SQL databases to use private endpoints with proper network isolation

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const sqlServer = new azurenative.sql.Server("my-sql-server", {
    publicNetworkAccess: "Disabled",  // Disable public access for private endpoints
    // ... other config
});

storage-account-files-encryption

Severity: high · Enforcement: advisory

Require Files to have encryption enabled

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    encryption: {
        services: {
            file: { enabled: true },  // Enable Azure Files encryption
        },
    },
    // ... other config
});

storage-account-firewall

Severity: high · Enforcement: advisory

Require Storage Accounts to have firewall rules configured

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    networkRuleSet: {
        defaultAction: "Deny",  // Deny by default
        ipRules: [{ value: "203.0.113.0/24" }],  // Allow specific IPs
        virtualNetworkRules: [{ id: subnet.id }],  // Allow specific subnets
    },
    // ... other config
});

storage-account-geo-replication

Severity: medium · Enforcement: advisory

Require Storage Accounts to have geo-replication enabled for business continuity

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_GRS" },  // Use geo-replicated SKU for redundancy
    kind: "StorageV2",
    // ... other config
});

storage-account-https-only

Severity: high · Enforcement: advisory

Require Storage Accounts to enforce HTTPS-only traffic

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    enableHttpsTrafficOnly: true,  // Enforce HTTPS-only traffic
    // ... other config
});

storage-account-least-privilege

Severity: high · Enforcement: advisory

Ensure storage accounts use appropriate storage-specific roles instead of broad management roles

• 01.v Information Access Restriction — Access to systems and applications shall be restricted in accordance with the access control policy.

const blobAssignment = new azurenative.authorization.RoleAssignment("blob-access", {
    roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe",  // Storage Blob Data Contributor
    principalId: appPrincipalId,
    scope: storageAccount.id,
    // ... other config
});

storage-account-public-access

Severity: critical · Enforcement: advisory

Require Storage Accounts to disable public blob access

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    allowBlobPublicAccess: false,  // Disable public blob access
    // ... other config
});

storage-account-public-network-access

Severity: critical · Enforcement: advisory

Require Storage Accounts to disable public network access

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: {
        name: "Standard_LRS",
    },
    kind: "StorageV2",
    publicNetworkAccess: "Disabled",  // Disable public network access
    // ... other config
});

storage-account-uses-customer-managed-keys

Severity: high · Enforcement: advisory

Require Storage Accounts to use customer-managed keys for encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    encryption: {
        keySource: "Microsoft.Keyvault",  // Use customer-managed keys
        keyVaultProperties: {
            keyName: "my-encryption-key",
            keyVaultUri: "https://my-keyvault.vault.azure.net/",
        },
    },
    // ... other config
});

synapse-workspace-customer-managed-keys

Severity: high · Enforcement: advisory

Require Synapse Analytics workspaces to use customer-managed keys for encryption

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const synapseWorkspace = new azurenative.synapse.Workspace("my-synapse-workspace", {
    encryption: {
        cmk: {
            key: {
                name: "my-encryption-key",
                keyVaultUrl: "https://my-keyvault.vault.azure.net/",
            },
            kekIdentity: {
                useSystemAssignedIdentity: true,  // Or use userAssignedIdentity
            },
        },
    },
    // ... other config
});

vm-approved-images

Severity: medium · Enforcement: advisory

Require pre-approved hardened VM images from trusted publishers

• 10.h Control of Operational Software — The installation of software on operational systems shall be controlled.

const vm = new azurenative.compute.VirtualMachine("my-vm", {
    hardwareProfile: { vmSize: "Standard_D2s_v3" },
    storageProfile: {
        imageReference: {
            publisher: "Canonical",              // Use approved publisher
            offer: "UbuntuServer",               // Use approved offer
            sku: "20.04-LTS",                    // Use approved SKU
            version: "latest",
        },
        // ... other config
    },
    // ... other config
});

vm-requires-managed-disks

Severity: medium · Enforcement: advisory

Require VMs to use managed disks only

• 06.d Data Protection and Privacy of Covered Information — Covered information shall be protected against unauthorized disclosure, modification and destruction. For the purpose of this control, covered information includes protected health information, cardholder data, and other sensitive information.

const vm = new azurenative.compute.VirtualMachine("my-vm", {
    hardwareProfile: { vmSize: "Standard_D2s_v3" },
    storageProfile: {
        osDisk: {
            createOption: "FromImage",
            managedDisk: {  // Use managed disk, not vhd property
                storageAccountType: "Premium_LRS",
            },
        },
        dataDisks: [{
            lun: 0,
            createOption: "Empty",
            diskSizeGB: 128,
            managedDisk: {  // Use managed disk, not vhd property
                storageAccountType: "Premium_LRS",
            },
        }],
        // ... other config
    },
    // ... other config
});

vm-scale-set-automatic-os-upgrades

Severity: medium · Enforcement: advisory

Require VM Scale Sets to have automatic OS upgrades enabled

• 10.k Change Control Procedures — Changes to systems within the development lifecycle shall be controlled by the use of formal change control procedures.

const vmss = new azurenative.compute.VirtualMachineScaleSet("my-vmss", {
    sku: { name: "Standard_D2s_v3", capacity: 3 },
    upgradePolicy: {
        mode: "Rolling",  // Use Rolling or Automatic mode
        automaticOSUpgradePolicy: {
            enableAutomaticOSUpgrade: true,  // Enable automatic OS upgrades
            disableAutomaticRollback: false,  // Allow automatic rollback on failures
        },
    },
    // ... other config
});

vm-scale-set-multi-az

Severity: medium · Enforcement: advisory

Require VM Scale Sets to span multiple availability zones

• 12.a Including Information Security in the Business Continuity Management — Information security shall be a central part of the organization’s business continuity management. Business continuity management shall include information security processes to ensure the required level of information security during adverse situations.

const vmss = new azurenative.compute.VirtualMachineScaleSet("my-vmss", {
    sku: { name: "Standard_D2s_v3", capacity: 3 },
    zones: ["1", "2", "3"],  // Deploy across multiple availability zones
    zoneBalance: true,       // Ensure even distribution across zones
    // ... other config
});

vm-scale-set-no-public-ip

Severity: critical · Enforcement: advisory

Require VM Scale Sets to have no public IP addresses

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const vmss = new azurenative.compute.VirtualMachineScaleSet("my-vmss", {
    sku: { name: "Standard_D2s_v3" },
    virtualMachineProfile: {
        networkProfile: {
            networkInterfaceConfigurations: [{
                name: "vmss-nic",
                primary: true,
                ipConfigurations: [{
                    name: "ipconfig1",
                    subnet: { id: subnet.id },
                    // Do NOT include publicIPAddressConfiguration
                }],
            }],
        },
        // ... other config
    },
});

vm-scale-set-require-managed-disks

Severity: medium · Enforcement: advisory

Require VM Scale Sets to use managed disks only

• 10.f Policy on the Use of Cryptographic Controls — Cryptographic controls shall be used in compliance with all relevant agreements, legislation and regulations, and risk assessments shall consider the organization’s business requirements.

const scaleSet = new azurenative.compute.VirtualMachineScaleSet("my-scale-set", {
    sku: { name: "Standard_D2s_v3" },
    virtualMachineProfile: {
        storageProfile: {
            osDisk: {
                createOption: "FromImage",
                managedDisk: {
                    storageAccountType: "Premium_LRS",  // Use managed disk for OS disk
                },
                // Do NOT use vhdContainers property
            },
            dataDisks: [{
                lun: 0,
                createOption: "Empty",
                diskSizeGB: 128,
                managedDisk: {
                    storageAccountType: "Premium_LRS",  // Use managed disk for data disks
                },
            }],
            // ... other config
        },
        // ... other config
    },
});

vnet-ddos-protection

Severity: high · Enforcement: advisory

Require Virtual Networks to have DDoS Protection Standard enabled

• 09.m Network Controls — Networks shall be managed and controlled in order to protect the organization from threats and to maintain security for the systems and applications using the network, including information in transit.

const vnet = new azurenative.network.VirtualNetwork("my-vnet", {
    enableDdosProtection: true,  // Enable DDoS protection
    ddosProtectionPlan: {
        id: ddosProtectionPlan.id,  // Reference DDoS Protection Plan for Standard tier
    },
    // ... other config
});

web-app-auth-settings

Severity: high · Enforcement: advisory

Require WebApp to have proper authentication settings configured

• 01.a Access Control Policy — All users shall have a unique identifier for their personal and sole use so that users can be linked to and made responsible for their actions.

const authSettings = new azurenative.web.WebAppAuthSettings("mywebapp-auth", {
    enabled: true,  // Enable authentication
    defaultProvider: "AzureActiveDirectory",
    unauthenticatedClientAction: "RedirectToLoginPage",
    tokenStoreEnabled: true,  // Enable secure token management
    azureActiveDirectoryProvider: {
        enabled: true,
        registration: {
            clientId: aadClientId,
        },
    },
    // ... other config
});