azure - 如何使用 Terraform 在 Azure 中启用自适应应用程序控件

Question

我收到了 Microsoft Defender for Cloud 的以下建议

Adaptive application controls for defining safe applications should be enabled on your machines

我确实浏览了这篇文章 - https://charbelnemnom.com/enable-adaptive-application-controls-in-azure-security-center并理解。

我想通过 Terraform 而不是手动启用此功能。我不知道从哪里开始。

Answer 1

还有另一种方法可以使用 Azure 内置的策略为 Azure VM 启用自适应应用程序控制 (AAC)。

自适应应用程序控制 (AAC) 是 Azure 策略的一项功能，可让你控制允许哪些应用程序在 Azure 虚拟机上运行。启用AAC需要为该功能创建并分配默认策略定义。像下面这样。

Azure 门户 > 策略 > 定义。

ARM 模板。

{
"properties": {
"displayName": "Adaptive application controls for defining safe applications should be enabled on your machines",

"policyType": "BuiltIn",

"mode": "All",


    "metadata": {
    "version": "3.0.0",
    "category": "Security Center"
    },
    "parameters": {
    "effect": {
    "type": "String",
    "metadata": {
    "displayName": "Effect",
    "description": "Enable or disable the execution of the policy"
    },
    "allowedValues": [
    "AuditIfNotExists",
    "Disabled"
    ],
    "defaultValue": "AuditIfNotExists"
    }
    },
    "policyRule": {
    "if": {
    "field": "type",
    "in": [
    "Microsoft.Compute/virtualMachines",
    "Microsoft.ClassicCompute/virtualMachines"
    ]
    },
    "then": {
    "effect": "[parameters('effect')]",
    "details": {
    
    "type": "Microsoft.Security/assessments",
    
    "name": "35f45c95-xxxx-xxxx-891f-8390d1de5828",
    "existenceCondition": {
    
    "field": "Microsoft.Security/assessments/status.code",
    
    "in": [
        "NotApplicable",
    "Healthy"
    ]
    }
    }
    }
    }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/47a6b606-51aa-xxxxxxxxx-64b11cf66adc", 
    "type": "Microsoft.Authorization/policyDefinitions", 
    "name": "47a6b606-xxxx-xxx-8bb7-64b11cf66adc"
    }

将策略分配到范围级别，如下所示。

使用Terraform分配内置的Azure Policy。就像下面这样。

provider "azurerm" {
    features {}
  }

  terraform { 
  required_providers { 
      azurerm = { 
          source = "hashicorp/azurerm"
          version = ">= 2.96.0" 
      } 
  } 
  }

您可以获取策略定义 ID，如下所示。

resource "azurerm_subscription_policy_assignment" "auditvms" { 
  name = "Adaptive application controls for defining safe applications should be enabled on your machines" 
  subscription_id = "<Subscription_ID>"
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d" 
  description = "Shows all virtual machines not using managed disks" 
  display_name = "Audit VMs without managed disks assignment" 
  }

引用:Create a policy assignment to identify non-compliant resources using Terraform .