diff --git a/.github/workflows/build-recommendation-object.yml b/.github/workflows/build-recommendation-object.yml index b7544871..16d6ee4e 100644 --- a/.github/workflows/build-recommendation-object.yml +++ b/.github/workflows/build-recommendation-object.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 with: ref: main diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml index dc931b36..f217c9ef 100644 --- a/.github/workflows/code-review.yml +++ b/.github/workflows/code-review.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 with: fetch-depth: 0 diff --git a/.github/workflows/hugo-build-pr-check.yml b/.github/workflows/hugo-build-pr-check.yml index d72f6ef8..806ef656 100644 --- a/.github/workflows/hugo-build-pr-check.yml +++ b/.github/workflows/hugo-build-pr-check.yml @@ -41,7 +41,7 @@ jobs: run: sudo snap install dart-sass-embedded - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 with: submodules: recursive fetch-depth: 0 diff --git a/.github/workflows/hugo-site-build.yml b/.github/workflows/hugo-site-build.yml index 0b8e9f88..dc453f62 100644 --- a/.github/workflows/hugo-site-build.yml +++ b/.github/workflows/hugo-site-build.yml @@ -52,7 +52,7 @@ jobs: run: sudo snap install dart-sass-embedded - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 with: submodules: recursive fetch-depth: 0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a24f74d0..ee1de129 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,7 +32,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + uses: actions/checkout@6b42224f41ee5dfe5395e27c8b2746f1f9955030 # v2.7.0 with: persist-credentials: false @@ -68,6 +68,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9 + uses: github/codeql-action/upload-sarif@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea # v3.26.11 with: sarif_file: results.sarif diff --git a/.github/workflows/validate-queries.yml b/.github/workflows/validate-queries.yml index 6ef7c7b5..8fc4d132 100644 --- a/.github/workflows/validate-queries.yml +++ b/.github/workflows/validate-queries.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 - name: Azure login (OIDC) uses: azure/login@v2 diff --git a/.github/workflows/validate-recommendations.yml b/.github/workflows/validate-recommendations.yml index 40bf937a..4a2ef000 100644 --- a/.github/workflows/validate-recommendations.yml +++ b/.github/workflows/validate-recommendations.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.0 - name: Set up Python 3.x uses: actions/setup-python@v5 diff --git a/azure-resources/ServiceBus/namespaces/kql/f075a1bd-de9e-4819-9a1d-1ac41037a74f.kql b/azure-resources/ServiceBus/namespaces/kql/f075a1bd-de9e-4819-9a1d-1ac41037a74f.kql new file mode 100644 index 00000000..6c18e8f1 --- /dev/null +++ b/azure-resources/ServiceBus/namespaces/kql/f075a1bd-de9e-4819-9a1d-1ac41037a74f.kql @@ -0,0 +1,11 @@ +// Azure Resource Graph Query +// Provides a list of Service Bus Namespace resources that have the lower minimum TLS version. +resources +| where type =~ "Microsoft.ServiceBus/namespaces" +| where properties.minimumTlsVersion in ("1.0", "1.1") +| project + recommendationId = "f075a1bd-de9e-4819-9a1d-1ac41037a74f", + name, + id, + tags, + param1 = strcat("minimumTlsVersion: ", properties.minimumTlsVersion) diff --git a/azure-resources/ServiceBus/namespaces/recommendations.yaml b/azure-resources/ServiceBus/namespaces/recommendations.yaml index 31f38e06..13e886ad 100644 --- a/azure-resources/ServiceBus/namespaces/recommendations.yaml +++ b/azure-resources/ServiceBus/namespaces/recommendations.yaml @@ -37,3 +37,23 @@ learnMoreLink: - name: Service Bus auto-scaling url: "https://learn.microsoft.com/azure/service-bus-messaging/automate-update-messaging-units" + +- description: Configure the minimum TLS version for Service Bus namespaces to TLS v1.2 or higher + aprlGuid: f075a1bd-de9e-4819-9a1d-1ac41037a74f + recommendationTypeId: null + recommendationControl: Service Upgrade and Retirement + recommendationImpact: High + recommendationResourceType: Microsoft.ServiceBus/namespaces + recommendationMetadataState: Active + longDescription: | + As of 31 October 2024, TLS 1.0 and TLS 1.1 will no longer be supported on Azure including Service Bus to enhance security and provide best-in-class encryption for your data. Change the minimum TLS version for your Service Bus namespace to TLS v1.2 or higher. + potentialBenefits: Avoids service disruption + pgVerified: false + publishedToLearn: false + automationAvailable: true + tags: null + learnMoreLink: + - name: Azure support for TLS 1.0 and TLS 1.1 will end by 31 October 2024 + url: "https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/" + - name: Configure the minimum TLS version for a Service Bus namespace + url: "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-configure-minimum-version" diff --git a/azure-resources/Storage/storageAccounts/kql/dc55be60-6f8c-461e-a9d5-a3c7686ed94e.kql b/azure-resources/Storage/storageAccounts/kql/dc55be60-6f8c-461e-a9d5-a3c7686ed94e.kql index 0dd9340c..d17752b3 100644 --- a/azure-resources/Storage/storageAccounts/kql/dc55be60-6f8c-461e-a9d5-a3c7686ed94e.kql +++ b/azure-resources/Storage/storageAccounts/kql/dc55be60-6f8c-461e-a9d5-a3c7686ed94e.kql @@ -3,6 +3,6 @@ resources | where type =~ "Microsoft.Storage/StorageAccounts" | where isnull(properties.privateEndpointConnections) or properties.privateEndpointConnections[0].properties.provisioningState != ("Succeeded") or (isnull(properties.networkAcls) and properties.publicNetworkAccess == 'Enabled') -| extend param1 = strcat('Private Endpoint: ', iif(isnotnull(properties.privateEndpointConnections),split(properties.privateEndpointConnections[0].properties.privateEndpoint.id,'/')[8],'No Private Endpoint')) +| extend param1 = strcat('Private Endpoint: ', iif(array_length(properties.privateEndpointConnections) != 0,split(properties.privateEndpointConnections[0].properties.privateEndpoint.id,'/')[8],'No Private Endpoint')) | extend param2 = strcat('Access: ', iif(properties.publicNetworkAccess == 'Disabled', 'Public Access Disabled', iif(isnotnull(properties.networkAcls), 'NetworkACLs in place','Public Access Enabled'))) | project recommendationId = "dc55be60-6f8c-461e-a9d5-a3c7686ed94e", name, id, tags, param1, param2 diff --git a/docs/content/contributing/create-content/create-recommendations/_index.md b/docs/content/contributing/create-content/create-recommendations/_index.md index 3e382d92..29593123 100644 --- a/docs/content/contributing/create-content/create-recommendations/_index.md +++ b/docs/content/contributing/create-content/create-recommendations/_index.md @@ -72,7 +72,7 @@ The YAML structure for adding new recommendations consists of several key-value | recommendationTypeId | 3464854d-6f75-4922-95e4-a2a308b53ce6 | String | `null` until updated by the Azure Advisor team | The unique identifier for the recommendation in the context of Advisor. | | recommendationControl | Monitoring and Alerting | String | [High Availability, Business Continuity, Disaster Recovery, Scalability, Monitoring and Alerting, Service Upgrade and Retirement, Other Best Practices, Personalized, Governance, Security](#recommendation-categories) | Resiliency category associated with the recommendation | | recommendationImpact | Medium | String | Low, Medium, High | Importance of adopting the recommendation and/or the risk of choosing not to adopt | -| recommendationResourceType | Storage Account | String | Align with the resource type | Friendly name to identity resource type | +| recommendationResourceType | Microsoft.Storage/storageAccounts | String | Align with the resource type | Friendly name to identity resource type | | recommendationMetadataState | Active | String | Active, Disabled | Indicates whether the recommendation is visible | | longDescription | To enable Cross-region disaster recovery and business continuity, ensure that the appropriate quotas are set for all user subscription Batch accounts. | String | The length should be less than 300 characters | Detailed description of the recommendation and its implications | | potentialBenefits | Enhanced data redundancy and boosts availability | String | The length should be less than 60 characters | The potential benefits of implementing the recommendation |