Service Bus - oWretch/policy GitHub Wiki

Policy Effects by Policy

Category	Policy	Platform	Landing Zones	Production	Decommissioned	Management	Corp	Connectivity	Sandbox	Identity
Service Bus	All authorization rules except RootManageSharedAccessKey should be removed from Service Bus namespace Service Bus clients should not use a namespace level access policy that provides access to all queues and topics in a namespace. To align with the least privilege security model, you should create access policies at the entity level for queues and topics to provide access to only the specific entity	Deny Disabled Audit	Deny Disabled Audit
Service Bus	Azure Service Bus namespaces should have local authentication methods disabled Disabling local authentication methods improves security by ensuring that Azure Service Bus namespaces exclusively require Microsoft Entra ID identities for authentication. Learn more at: https://aka.ms/disablelocalauth-sb.	Deny Disabled Audit	Deny Disabled Audit
Service Bus	Configure Azure Service Bus namespaces to disable local authentication Disable local authentication methods so that your Azure ServiceBus namespaces exclusively require Microsoft Entra ID identities for authentication. Learn more at: https://aka.ms/disablelocalauth-sb.	Modify Disabled	Modify Disabled
Service Bus	Configure Service Bus namespaces to use private DNS zones Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to Service Bus namespaces. Learn more at: https://docs.microsoft.com/azure/service-bus-messaging/private-link-service.						DeployIfNotExists Disabled
Service Bus	Resource logs in Service Bus should be enabled Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised			AuditIfNotExists Disabled
Service Bus	Service Bus Namespaces should disable public network access Azure Service Bus should have public network access disabled. Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. You can limit exposure of your resources by creating private endpoints instead. Learn more at: https://docs.microsoft.com/azure/service-bus-messaging/private-link-service						Deny Disabled Audit
Service Bus	Service Bus namespaces should have double encryption enabled Enabling double encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. When double encryption has been enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different encryption algorithms and two different keys.	Deny Disabled Audit	Deny Disabled Audit
Service Bus	Service Bus Premium namespaces should use a customer-managed key for encryption Azure Service Bus supports the option of encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys. Choosing to encrypt data using customer-managed keys enables you to assign, rotate, disable, and revoke access to the keys that Service Bus will use to encrypt data in your namespace. Note that Service Bus only supports encryption with customer-managed keys for premium namespaces.	Audit Disabled	Audit Disabled

Policy Parameters by Policy

Category	Policy	Platform	Landing Zones	Production	Decommissioned	Management	Corp	Connectivity	Sandbox	Identity
Service Bus	Configure Service Bus namespaces to use private DNS zones Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to Service Bus namespaces. Learn more at: https://docs.microsoft.com/azure/service-bus-messaging/private-link-service.						azureServiceBusNamespacePrivateDnsZoneId = `--DNSZonePrefix--privatelink.servicebus...`
Service Bus	Resource logs in Service Bus should be enabled Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised			diagnosticsLogsInServiceBusRetentionDays = `1`

⚠️ GitHub.com Fallback ⚠️