azure_compliance

Azure Compliance

Run pipelines to detect and correct Azure resources that are non-compliant with CIS benchmarks.

azure_cis

azure_cis.pipeline.cis_v300

CIS v3.0.0

azure_cis.pipeline.cis_v300_10

10 Miscellaneous

azure_cis.pipeline.cis_v300_10_1

10.1 Ensure that Resource Locks are set for Mission-Critical Azure Resources

azure_cis.pipeline.cis_v300_2

2 Identity

azure_cis.pipeline.cis_v300_2_10

2.10 Ensure that 'Notify users on password resets?' is set to 'Yes'

azure_cis.pipeline.cis_v300_2_11

2.11 Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'

azure_cis.pipeline.cis_v300_2_12

2.12 Ensure 'User consent for applications' is set to 'Do not allow user consent'

azure_cis.pipeline.cis_v300_2_13

2.13 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'

azure_cis.pipeline.cis_v300_2_14

2.14 Ensure That 'Users Can Register Applications' Is Set to 'No'

azure_cis.pipeline.cis_v300_2_15

2.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'

azure_cis.pipeline.cis_v300_2_16

2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'

azure_cis.pipeline.cis_v300_2_17

2.17 Ensure That 'Restrict access to Microsoft Entra admin center' is Set to 'Yes'

azure_cis.pipeline.cis_v300_2_18

2.18 Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes'

azure_cis.pipeline.cis_v300_2_19

2.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'

azure_cis.pipeline.cis_v300_2_1_1

2.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID

azure_cis.pipeline.cis_v300_2_1_2

2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users

azure_cis.pipeline.cis_v300_2_1_3

2.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users

azure_cis.pipeline.cis_v300_2_1_4

2.1.4 Ensure that 'Allow users to remember multi-factor authentication on devices they trust' is Disabled

azure_cis.pipeline.cis_v300_2_20

2.20 Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No'

azure_cis.pipeline.cis_v300_2_21

2.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

azure_cis.pipeline.cis_v300_2_22

2.22 Ensure that 'Require Multi-Factor Authentication to register or join devices with Microsoft Entra ID' is set to 'Yes'

azure_cis.pipeline.cis_v300_2_23

2.23 Ensure That No Custom Subscription Administrator Roles Exist

azure_cis.pipeline.cis_v300_2_24

2.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks

azure_cis.pipeline.cis_v300_2_25

2.25 Ensure That `Subscription leaving Microsoft Entra ID directory` and `Subscription entering Microsoft Entra ID directory` Is Set To 'Permit No One'

azure_cis.pipeline.cis_v300_2_26

2.26 Ensure fewer than 5 users have global administrator assignment

azure_cis.pipeline.cis_v300_2_2_1

2.2.1 Ensure Trusted Locations Are Defined

azure_cis.pipeline.cis_v300_2_2_2

2.2.2 Ensure that an exclusionary Geographic Access Policy is considered

azure_cis.pipeline.cis_v300_2_2_3

2.2.3 Ensure that an exclusionary Device code flow policy is considered

azure_cis.pipeline.cis_v300_2_2_4

2.2.4 Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups

azure_cis.pipeline.cis_v300_2_2_5

2.2.5 Ensure that A Multi-factor Authentication Policy Exists for All Users

azure_cis.pipeline.cis_v300_2_2_6

2.2.6 Ensure Multi-factor Authentication is Required for Risky Sign-ins

azure_cis.pipeline.cis_v300_2_2_7

2.2.7 Ensure Multifactor Authentication is Required for Windows Azure Service Management API

azure_cis.pipeline.cis_v300_2_2_8

2.2.8 Ensure Multifactor Authentication is Required to access Microsoft Admin Portals

azure_cis.pipeline.cis_v300_2_3

2.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'

azure_cis.pipeline.cis_v300_2_4

2.4 Ensure Guest Users Are Reviewed on a Regular Basis

azure_cis.pipeline.cis_v300_2_5

2.5 Ensure That 'Number of methods required to reset' is set to '2'

azure_cis.pipeline.cis_v300_2_6

2.6 Ensure that account 'Lockout Threshold' is less than or equal to '10'

azure_cis.pipeline.cis_v300_2_7

2.7 Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'

azure_cis.pipeline.cis_v300_2_8

2.8 Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization

azure_cis.pipeline.cis_v300_2_9

2.9 Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0'

azure_cis.pipeline.cis_v300_3

3 Security

azure_cis.pipeline.cis_v300_3_1_10

3.1.10 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'

azure_cis.pipeline.cis_v300_3_1_11

3.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'

azure_cis.pipeline.cis_v300_3_1_12

3.1.12 Ensure That 'All users with the following roles' is set to 'Owner'

azure_cis.pipeline.cis_v300_3_1_13

3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email

azure_cis.pipeline.cis_v300_3_1_14

3.1.14 Ensure That 'Notify about alerts with the following severity' is Set to 'High'

azure_cis.pipeline.cis_v300_3_1_15

3.1.15 Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled

azure_cis.pipeline.cis_v300_3_1_16

3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_1_1

3.1.1.1 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'

azure_cis.pipeline.cis_v300_3_1_1_2

3.1.1.2 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected

azure_cis.pipeline.cis_v300_3_1_3_1

3.1.3.1 Ensure That Microsoft Defender for Servers Is Set to 'On'

azure_cis.pipeline.cis_v300_3_1_3_2

3.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'

azure_cis.pipeline.cis_v300_3_1_3_3

3.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'

azure_cis.pipeline.cis_v300_3_1_3_4

3.1.3.4 Ensure that 'Agentless scanning for machines' component status is set to 'On'

azure_cis.pipeline.cis_v300_3_1_3_5

3.1.3.5 Ensure that 'File Integrity Monitoring' component status is set to 'On'

azure_cis.pipeline.cis_v300_3_1_4_1

3.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_4_2

3.1.4.2 Ensure that 'Agentless discovery for Kubernetes' component status 'On'

azure_cis.pipeline.cis_v300_3_1_4_3

3.1.4.3 Ensure that 'Agentless container vulnerability assessment' component status is 'On'

azure_cis.pipeline.cis_v300_3_1_5_1

3.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_6_1

3.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_7_1

3.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_7_2

3.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_7_3

3.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_7_4

3.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_8_1

3.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On'

azure_cis.pipeline.cis_v300_3_1_9_1

3.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On'

azure_cis.pipeline.cis_v300_3_2_1

3.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'

azure_cis.pipeline.cis_v300_3_3_1

3.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults

azure_cis.pipeline.cis_v300_3_3_2

3.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults

azure_cis.pipeline.cis_v300_3_3_3

3.3.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults

azure_cis.pipeline.cis_v300_3_3_4

3.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults

azure_cis.pipeline.cis_v300_3_3_5

3.3.5 Ensure the Key Vault is Recoverable

azure_cis.pipeline.cis_v300_3_3_6

3.3.6 Enable Role Based Access Control for Azure Key Vault

azure_cis.pipeline.cis_v300_3_3_7

3.3.7 Ensure that Private Endpoints are Used for Azure Key Vault

azure_cis.pipeline.cis_v300_3_3_8

3.3.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services

azure_cis.pipeline.cis_v300_4

4 Storage Accounts

azure_cis.pipeline.cis_v300_4_1

4.1 Ensure that 'Secure transfer required' is set to 'Enabled'

azure_cis.pipeline.cis_v300_4_10

4.10 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage

azure_cis.pipeline.cis_v300_4_11

4.11 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys

azure_cis.pipeline.cis_v300_4_12

4.12 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests

azure_cis.pipeline.cis_v300_4_13

4.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests

azure_cis.pipeline.cis_v300_4_14

4.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests

azure_cis.pipeline.cis_v300_4_15

4.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'

azure_cis.pipeline.cis_v300_4_16

4.16 Ensure 'Cross Tenant Replication' is not enabled

azure_cis.pipeline.cis_v300_4_17

4.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled`

azure_cis.pipeline.cis_v300_4_2

4.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'

azure_cis.pipeline.cis_v300_4_3

4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account

azure_cis.pipeline.cis_v300_4_4

4.4 Ensure that Storage Account Access Keys are Periodically Regenerated

azure_cis.pipeline.cis_v300_4_5

4.5 Ensure that Shared Access Signature Tokens Expire Within an Hour

azure_cis.pipeline.cis_v300_4_6

4.6 Ensure that 'Public Network Access' is `Disabled' for storage accounts

azure_cis.pipeline.cis_v300_4_7

4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny

azure_cis.pipeline.cis_v300_4_8

4.8 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access

azure_cis.pipeline.cis_v300_4_9

4.9 Ensure Private Endpoints are used to access Storage Accounts

azure_cis.pipeline.cis_v300_5

5 Database Services

azure_cis.pipeline.cis_v300_5_1_1

5.1.1 Ensure that 'Auditing' is set to 'On'

azure_cis.pipeline.cis_v300_5_1_2

5.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)

azure_cis.pipeline.cis_v300_5_1_3

5.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`

Pipeline: 5 Database Services

Overview

Run the pipeline

Use this pipeline

Params

Outputs

Tags