diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 2c1e12fd4..e30f8b254 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -8,7 +8,16 @@ ### Breaking Changes diff --git a/.github/scripts/schemas/azure-resources-schema.yaml b/.github/scripts/schemas/azure-resources-schema.yaml index 5616b4123..b8887eecd 100644 --- a/.github/scripts/schemas/azure-resources-schema.yaml +++ b/.github/scripts/schemas/azure-resources-schema.yaml @@ -7,7 +7,7 @@ recommendation: recommendationTypeId: any(regex('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'), null()) recommendationControl: enum('High Availability', 'Business Continuity', 'Disaster Recovery', 'Scalability', 'Monitoring and Alerting', 'Service Upgrade and Retirement', 'Other Best Practices', 'Personalized', 'Governance', 'Security') recommendationImpact: enum('Low', 'Medium', 'High') - recommendationResourceType: regex('^Microsoft.[a-zA-Z.]+/[a-zA-Z]+$') + recommendationResourceType: regex('^Microsoft\.[a-zA-Z0-9.]+/[a-zA-Z0-9]+$') recommendationMetadataState: enum('Active', 'Disabled') longDescription: str(max=300) potentialBenefits: str(max=60) diff --git a/.github/workflows/hugo-site-build.yml b/.github/workflows/hugo-site-build.yml index 1d74a210c..0b8e9f88c 100644 --- a/.github/workflows/hugo-site-build.yml +++ b/.github/workflows/hugo-site-build.yml @@ -93,6 +93,7 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest needs: build + if: github.ref == 'refs/heads/main' steps: - name: Deploy to GitHub Pages id: deployment diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml new file mode 100644 index 000000000..8653fa4ef --- /dev/null +++ b/.github/workflows/pr-title-check.yml @@ -0,0 +1,17 @@ +name: .Platform - Semantic PR Check + +on: + pull_request_target: + types: + - opened + - edited + - synchronize + +jobs: + main: + name: Validate PR Title + runs-on: ubuntu-latest + steps: + - uses: amannn/action-semantic-pull-request@v5 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 000000000..3be0fd217 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,73 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '20 1 * * 4' + push: + branches: [ "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: "Checkout code" + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. + repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 + with: + sarif_file: results.sarif diff --git a/CODEOWNERS b/CODEOWNERS index 439b70425..41c83768e 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,29 +1,29 @@ -# The aprl-admins team is responsible for reviewing and merging all PRs +# The aprl-maintainers team is responsible for reviewing and merging all PRs -* @Azure/aprl-admins +* @Azure/aprl-maintainers ## The aprl-networking team is partially responsible for all networking-related PRs -azure-resources/Cdn @Azure/aprl-admins @Azure/aprl-networking -azure-resources/Network @Azure/aprl-admins @Azure/aprl-networking -azure-resources/NetworkCloud @Azure/aprl-admins @Azure/aprl-networking -azure-resources/NetworkFunction @Azure/aprl-admins @Azure/aprl-networking -azure-resources/Peerings @Azure/aprl-admins @Azure/aprl-networking -azure-resources/Relay @Azure/aprl-admins @Azure/aprl-networking +azure-resources/Cdn @Azure/aprl-maintainers @Azure/aprl-networking +azure-resources/Network @Azure/aprl-maintainers @Azure/aprl-networking +azure-resources/NetworkCloud @Azure/aprl-maintainers @Azure/aprl-networking +azure-resources/NetworkFunction @Azure/aprl-maintainers @Azure/aprl-networking +azure-resources/Peerings @Azure/aprl-maintainers @Azure/aprl-networking +azure-resources/Relay @Azure/aprl-maintainers @Azure/aprl-networking ## The aprl-sap team is partially responsible for all SAP-related PRs -azure-specialized-workloads/sap @Azure/aprl-admins @Azure/aprl-sap +azure-specialized-workloads/sap @Azure/aprl-maintainers @Azure/aprl-sap ## The aprl-hpc team is partially responsible for all HPC-related PRs -azure-resources/Batch @Azure/aprl-admins @Azure/aprl-hpc -azure-specialized-workloads/hpc @Azure/aprl-admins @Azure/aprl-hpc +azure-resources/Batch @Azure/aprl-maintainers @Azure/aprl-hpc +azure-specialized-workloads/hpc @Azure/aprl-maintainers @Azure/aprl-hpc ## The aprl-avd team is partially responsible for all AVD-related PRs -azure-resources/DesktopVirtualization @Azure/aprl-admins @Azure/aprl-avd -azure-specialized-workloads/avd @Azure/aprl-admins @Azure/aprl-avd +azure-resources/DesktopVirtualization @Azure/aprl-maintainers @Azure/aprl-avd +azure-specialized-workloads/avd @Azure/aprl-maintainers @Azure/aprl-avd ## The aprl-wara-tools team is responsible for all WARA tools-related PRs diff --git a/README.md b/README.md index 379043bb7..67e23fdb5 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,7 @@ [![Average time to resolve an issue](http://isitmaintained.com/badge/resolution/Azure/Azure-Proactive-Resiliency-Library-v2.svg)](http://isitmaintained.com/project/Azure/Azure-Proactive-Resiliency-Library-v2 "Average time to resolve an issue") [![Percentage of issues still open](http://isitmaintained.com/badge/open/Azure/Azure-Proactive-Resiliency-Library-v2.svg)](http://isitmaintained.com/project/Azure/Azure-Proactive-Resiliency-Library-v2 "Percentage of issues still open") +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Azure/ALZ-Bicep/badge)](https://scorecard.dev/viewer/?uri=github.com/Azure/ALZ-Bicep) > **Please access the GitHub Pages site, unless looking to contribute, over at: [aka.ms/aprl](https://aka.ms/aprl)** diff --git a/azure-resources/Compute/virtualMachines/recommendations.yaml b/azure-resources/Compute/virtualMachines/recommendations.yaml index ac8f8222e..18d0be8bf 100644 --- a/azure-resources/Compute/virtualMachines/recommendations.yaml +++ b/azure-resources/Compute/virtualMachines/recommendations.yaml @@ -46,7 +46,7 @@ recommendationResourceType: Microsoft.Compute/virtualMachines recommendationMetadataState: Active longDescription: | - While availability sets are not scheduled for immediate deprecation, they are planned to be deprecated in the future. Migrate workloads from VMs to VMSS Flex for deployment across zones or within the same zone across different fault domains (FDs) and update domains (UDs) for better reliability. + While availability sets are not scheduled for immediate deprecation, they are planned to be deprecated in the future. Migrate workloads from VMs to VMSS Flex for deployment across zones or within the same zone across different fault domains (FDs) for better reliability. potentialBenefits: Enhances reliability and future-proofs VMs pgVerified: true publishedToLearn: false @@ -54,8 +54,8 @@ automationAvailable: arg tags: null learnMoreLink: - - name: Resiliency checklist for Virtual Machines - url: "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service#virtual-machines" + - name: Migrate deployments and resources to Virtual Machine Scale Sets in Flexible orchestration + url: "https://learn.microsoft.com/azure/virtual-machine-scale-sets/flexible-virtual-machine-scale-sets-migration-resources" - description: Replicate VMs using Azure Site Recovery aprlGuid: cfe22a65-b1db-fd41-9e8e-d573922709ae diff --git a/azure-resources/Network/expressRouteGateways/_index.md b/azure-resources/Network/expressRouteGateways/_index.md index 49e80942d..cc5791c1c 100644 --- a/azure-resources/Network/expressRouteGateways/_index.md +++ b/azure-resources/Network/expressRouteGateways/_index.md @@ -1,7 +1,7 @@ --- title: expressRouteGateways geekdocCollapseSection: true -geekdocHidden: true +geekdocHidden: false --- {{< azure-resources-recommendationlist name="azure-resources-recommendationlist" >}} diff --git a/azure-resources/Network/expressRouteGateways/kql/17e8d380-e4b4-41a1-9b37-2e4df9fd5125.kql b/azure-resources/Network/expressRouteGateways/kql/17e8d380-e4b4-41a1-9b37-2e4df9fd5125.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/expressRouteGateways/kql/17e8d380-e4b4-41a1-9b37-2e4df9fd5125.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/expressRouteGateways/kql/9987c813-d687-4163-a511-95f31bc5e536.kql b/azure-resources/Network/expressRouteGateways/kql/9987c813-d687-4163-a511-95f31bc5e536.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/expressRouteGateways/kql/9987c813-d687-4163-a511-95f31bc5e536.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/expressRouteGateways/recommendations.yaml b/azure-resources/Network/expressRouteGateways/recommendations.yaml new file mode 100644 index 000000000..959f5c40e --- /dev/null +++ b/azure-resources/Network/expressRouteGateways/recommendations.yaml @@ -0,0 +1,35 @@ +- description: Connect v-Hub's ExpressRoute gateway to circuits from diverse peering locations for resilience + aprlGuid: 9987c813-d687-4163-a511-95f31bc5e536 + recommendationTypeId: null + recommendationControl: High Availability + recommendationImpact: High + recommendationResourceType: Microsoft.Network/expressRouteGateways + recommendationMetadataState: Active + longDescription: To increase reliability, it's advised that each v-Hub's ExpressRoute gateway connects to at least two circuits, with each circuit originating from a different peering location than the other, ensuring diverse connectivity paths for enhanced resilience.| + potentialBenefits: Enhance resiliency for Azure Service + pgVerified: false + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Designing for disaster recovery with ExpressRoute private peering + url: "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering" + +- description: Monitor health for v-Hub's ExpressRoute gateway + aprlGuid: 17e8d380-e4b4-41a1-9b37-2e4df9fd5125 + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: High + recommendationResourceType: Microsoft.Network/expressRouteGateways + recommendationMetadataState: Active + longDescription: Set up monitoring and alerts for Virtual WAN Express Route Gateway. Create alert rule for ensuring promptly response to critical events such as exceeding packets per second, exceeding BGP routes prefixes, Gateway overutilization and high frequency in route changes. + potentialBenefits: Detection and mitigation to avoid disruptions. + pgVerified: false + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Virtual WAN Monitoring Best Practices + url: "https://learn.microsoft.com/en-us/azure/virtual-wan/monitoring-best-practices#expressroute-gateway" diff --git a/azure-resources/Network/networkWatchers/kql/a1317a0b-402d-4604-be40-a25a004ba171.kql b/azure-resources/Network/networkWatchers/kql/a1317a0b-402d-4604-be40-a25a004ba171.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/networkWatchers/kql/a1317a0b-402d-4604-be40-a25a004ba171.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/networkWatchers/kql/bf0b7dbd-016d-458c-af99-70fcb03ad451.kql b/azure-resources/Network/networkWatchers/kql/bf0b7dbd-016d-458c-af99-70fcb03ad451.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/networkWatchers/kql/bf0b7dbd-016d-458c-af99-70fcb03ad451.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/networkWatchers/recommendations.yaml b/azure-resources/Network/networkWatchers/recommendations.yaml index 2db3ce1e7..fc9dc2c98 100644 --- a/azure-resources/Network/networkWatchers/recommendations.yaml +++ b/azure-resources/Network/networkWatchers/recommendations.yaml @@ -54,3 +54,41 @@ learnMoreLink: - name: Connection monitor overview url: "https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview" + +- description: Enable Network Security Group and Virtual Network Flow Logs + aprlGuid: a1317a0b-402d-4604-be40-a25a004ba171 + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: High + recommendationResourceType: Microsoft.Network/networkWatchers + recommendationMetadataState: Active + longDescription: | + Improves monitoring and security for Azure and Hybrid connectivity + potentialBenefits: Improves monitoring and security for Azure connectivity + pgVerified: true + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: NSG and VNET Flow logs + url: "https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview" + +- description: Enable traffic analytics in Network Security Group and Virtual Network Flow Logs configuration. + aprlGuid: bf0b7dbd-016d-458c-af99-70fcb03ad451 + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: High + recommendationResourceType: Microsoft.Network/networkWatchers + recommendationMetadataState: Active + longDescription: | + Improves monitoring, security and troubleshooting for Azure and Hybrid connectivity + potentialBenefits: Improves monitoring, security and troubleshooting. + pgVerified: true + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Network watcher traffic analytics + url: "https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics" diff --git a/azure-resources/Network/p2sVpnGateways/kql/fd43ea32-2ccf-49a8-ada4-9a78794e3ff1.kql b/azure-resources/Network/p2sVpnGateways/kql/fd43ea32-2ccf-49a8-ada4-9a78794e3ff1.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/p2sVpnGateways/kql/fd43ea32-2ccf-49a8-ada4-9a78794e3ff1.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/p2sVpnGateways/recommendations.yaml b/azure-resources/Network/p2sVpnGateways/recommendations.yaml new file mode 100644 index 000000000..a556451e3 --- /dev/null +++ b/azure-resources/Network/p2sVpnGateways/recommendations.yaml @@ -0,0 +1,17 @@ +- description: Monitor health for v-Hub's Point-to-Site VPN gateways + aprlGuid: fd43ea32-2ccf-49a8-ada4-9a78794e3ff1 + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: High + recommendationResourceType: Microsoft.Network/p2sVpnGateways + recommendationMetadataState: Active + longDescription: Set up monitoring and alerts for Point-to-Site VPN gateways. Create alert rule for ensuring promptly response to critical events such as Gateway overutilization, connection count limits and User VPN route limits. + potentialBenefits: Detection and mitigation to avoid disruptions. + pgVerified: false + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Virtual WAN Monitoring Best Practices + url: "https://learn.microsoft.com/en-us/azure/virtual-wan/monitoring-best-practices#point-to-site-vpn-gateway" diff --git a/azure-resources/Network/virtualHubs/_index.md b/azure-resources/Network/virtualHubs/_index.md index 4101a3edd..fcbb0fb03 100644 --- a/azure-resources/Network/virtualHubs/_index.md +++ b/azure-resources/Network/virtualHubs/_index.md @@ -1,7 +1,7 @@ --- title: virtualHubs geekdocCollapseSection: true -geekdocHidden: true +geekdocHidden: false --- {{< azure-resources-recommendationlist name="azure-resources-recommendationlist" >}} diff --git a/azure-resources/Network/virtualHubs/kql/0390bf34-8be5-44ee-b454-d6b8d5dd3790.kql b/azure-resources/Network/virtualHubs/kql/0390bf34-8be5-44ee-b454-d6b8d5dd3790.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/virtualHubs/kql/0390bf34-8be5-44ee-b454-d6b8d5dd3790.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/virtualHubs/recommendations.yaml b/azure-resources/Network/virtualHubs/recommendations.yaml new file mode 100644 index 000000000..6eb0012f9 --- /dev/null +++ b/azure-resources/Network/virtualHubs/recommendations.yaml @@ -0,0 +1,17 @@ +- description: Monitor health for v-Hubs + aprlGuid: 30ec8a5e-46de-4323-87e9-a7c56b72813b + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: Medium + recommendationResourceType: Microsoft.Network/virtualHubs + recommendationMetadataState: Active + longDescription: Set up monitoring and alerts for v-Hubs. Create alert rule for ensuring promptly response to changes in BGP status and Data processed by v-Hubs. + potentialBenefits: Detection and mitigation to avoid disruptions. + pgVerified: false + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Virtual WAN Monitoring Best Practices + url: "https://learn.microsoft.com/en-us/azure/virtual-wan/monitoring-best-practices#virtual-hub" diff --git a/azure-resources/Network/vpnGateways/kql/f0d4f766-ac19-48c4-b228-4601cc038baa.kql b/azure-resources/Network/vpnGateways/kql/f0d4f766-ac19-48c4-b228-4601cc038baa.kql new file mode 100644 index 000000000..614a7f9ca --- /dev/null +++ b/azure-resources/Network/vpnGateways/kql/f0d4f766-ac19-48c4-b228-4601cc038baa.kql @@ -0,0 +1 @@ +// under-development diff --git a/azure-resources/Network/vpnGateways/recommendations.yaml b/azure-resources/Network/vpnGateways/recommendations.yaml new file mode 100644 index 000000000..88b51e12d --- /dev/null +++ b/azure-resources/Network/vpnGateways/recommendations.yaml @@ -0,0 +1,17 @@ +- description: Monitor gateway for Site-to-site v-Hub's VPN gateway + aprlGuid: f0d4f766-ac19-48c4-b228-4601cc038baa + recommendationTypeId: null + recommendationControl: Monitoring and Alerting + recommendationImpact: High + recommendationResourceType: Microsoft.Network/vpnGateways + recommendationMetadataState: Active + longDescription: Set up monitoring and alerts for v-Hub's VPN Gateway. Create alert rule for ensuring promptly response to critical events such as packet drop counts, BGP status, Gateway overutilization. + potentialBenefits: Detection and mitigation to avoid disruptions. + pgVerified: false + publishedToLearn: false + publishedToAdvisor: false + automationAvailable: no + tags: null + learnMoreLink: + - name: Virtual WAN Monitoring Best Practices + url: "https://learn.microsoft.com/en-us/azure/virtual-wan/monitoring-best-practices#virtual-wan-gateways"