tanzu-guardrails_3b.ss_azure.11.sls

META:
  name: VMware Aria Automation for Secure Clouds - CIS AZURE foundation Benchmark 1.5.0
  provider: SecureState
  category: SECURITY
  subcategory: Reference
  template_id: 3b.ss_azure.11
  version: v1
  description: Enables CIS AZURE foundation Benchmark 1.5.0 framework and all of its rules in VMware Aria Secure Clouds. In monitor mode, it verifies if the framework and the rules are enabled in VMware Aria Secure Clouds.

{% set severity = 'All' %}

The CIS Azure Foundation framework in VMware Aria Automation for Secure Clouds is not enabled:
  META:
    name: Enable CIS AZURE foundation Benchmark 1.5.0 in VMware Aria Secure Clouds
    policy_description: "Enables CIS AZURE foundation Benchmark 1.5.0 framework in VMware Aria Automation for Secure Clouds. In monitor mode, it verifies if the framework is enabled VMware Aria Automation for Secure Clouds."
    finding_description: "The CIS Azure Foundation framework in VMware Aria Automation for Secure Clouds is not enabled."
  securestate.framework.present:
  - name: CIS AZURE foundation Benchmark 1.5.0
  - id: 'cadac55d-1150-41f3-854c-03d668112cfd'
  - status: Enabled

One or more of the CIS Azure Foundation rules in VMware Aria Automation for Secure Clouds is not enabled:
  META:
    name: Enable all rules for CIS AZURE foundation Benchmark 1.5.0 in VMware Aria Secure Clouds
    policy_description: "Enables all the rules in CIS AZURE foundation Benchmark 1.5.0 framework in VMware Aria Automation for Secure Clouds. In monitor mode, it verifies if the rules of framework are enabled in VMware Aria Automation for Secure Clouds."
    finding_description: "One or more of the rules from the CIS Azure Foundation framework in VMware Aria Automation for Secure Clouds is not enabled."
  exec.run:
    - require:
        - securestate.framework: The CIS Azure Foundation framework in VMware Aria Automation for Secure Clouds is not enabled
    - path: securestate.framework.get_rule_by_frameworkId
    - kwargs:
        id: 'cadac55d-1150-41f3-854c-03d668112cfd'
        status: Enabled
        filter:
            severity: {{ severity }}

#!require:One or more of the CIS Azure Foundation rules in VMware Aria Automation for Secure Clouds is not enabled

{% for rule_id in hub.idem.arg_bind.resolve('${exec:One or more of the CIS Azure Foundation rules in VMware Aria Automation for Secure Clouds is not enabled}') %}
Rule - {{rule_id}} is not enabled:
  securestate.rule.present:
  - id: {{rule_id}}
  - status: Enabled
{% endfor %}

下記の投稿むけ。

Tanzu Guardrails のなかで Aria Automation for Secure Clouds は生きている。
https://vm.gowatana.jp/entry/2023/10/13/085928