forked from gettek/terraform-azurerm-policy-as-code
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathassignments_org.tf
82 lines (72 loc) · 2.81 KB
/
assignments_org.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
##################
# General
##################
module "org_mg_whitelist_regions" {
source = "..//modules/def_assignment"
definition = module.whitelist_regions.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
assignment_parameters = {
"listOfRegionsAllowed" = [
"UK South",
"UK West",
"Global"
]
}
}
##################
# Security Center
##################
module "org_mg_configure_asc_initiative" {
source = "..//modules/set_assignment"
initiative = module.configure_asc_initiative.initiative
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "DeployIfNotExists"
skip_remediation = var.skip_remediation
skip_role_assignment = var.skip_role_assignment
role_definition_ids = module.configure_asc_initiative.role_definition_ids
assignment_parameters = {
workspaceId = local.dummy_resource_ids.azurerm_log_analytics_workspace
eventHubDetails = local.dummy_resource_ids.azurerm_eventhub_namespace_authorization_rule
securityContactsEmail = "[email protected]"
securityContactsPhone = "44897654987"
}
}
##################
# Monitoring
##################
module "org_mg_platform_diagnostics_initiative" {
source = "..//modules/set_assignment"
initiative = module.platform_diagnostics_initiative.initiative
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "DeployIfNotExists"
skip_remediation = var.skip_remediation
skip_role_assignment = var.skip_role_assignment
role_definition_ids = [
data.azurerm_role_definition.contributor.id # using explicit roles
]
role_assignment_scope = data.azurerm_management_group.team_a.id # using explicit scopes
assignment_parameters = {
workspaceId = local.dummy_resource_ids.azurerm_log_analytics_workspace
storageAccountId = local.dummy_resource_ids.azurerm_storage_account
eventHubName = local.dummy_resource_ids.azurerm_eventhub_namespace
eventHubAuthorizationRuleId = local.dummy_resource_ids.azurerm_eventhub_namespace_authorization_rule
metricsEnabled = "True"
logsEnabled = "True"
}
}
##################
# Storage
##################
module "org_mg_storage_enforce_https" {
source = "..//modules/def_assignment"
definition = module.storage_enforce_https.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
}
module "org_mg_storage_enforce_minimum_tls1_2" {
source = "..//modules/def_assignment"
definition = module.storage_enforce_minimum_tls1_2.definition
assignment_scope = data.azurerm_management_group.org.id
assignment_effect = "Deny"
}