Контекст моей среды : я запустил пользовательскую политику организации, в которой я добавил ее в свой конвейер cz / cd для Azure Devops.Затем я добавил группу ресурсов AzSKRG и с помощью команды Get-AzSKAzureServicesSecurityStatus добавил статусы аттестации к некоторым элементам управления, которые, по моему мнению, не являются необходимыми для сбоя конвейера.Но с последним шагом у меня есть некоторые проблемы
Я пытаюсь сделать некоторые из руководства и проверить элементы управления "пройденными", чтобы моя команда разработчиков могла выполнить это безупречно в конвейере, и я просто проверяюконтроль один раз каждые 90 дней (срок годности).Проблема у меня есть банкомат является то, что я не могу добавить аттестационный statusses этим ControlID в
1009 * Azure_APIManagement_AuthZ_Restrict_Caller_IPs Azure_APIManagement_DP_Restrict_Critical_APIs_Access Azure_KeyVault_AuthZ_Grant_Min_Access_policies Azure_APIManagement_DP_Use_Secure_TLS_Version Azure_APIManagement_DP_Dont_Reveal_Backend_Info Azure_APIManagement_AuthZ_Enable_Requires_Approval 1011 * для keyvault я понятия не имею, почему я не могу добавить аттестациистатус.это мой вывод моей команды powershell
================================================================================
AzSK Version: 3.8.0
================================================================================
Method Name: Get-AzSKAzureServicesSecurityStatus (GRS)
Input Parameters:
Name Alias Value
---- ----- -----
SubscriptionId s xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DoNotOpenOutputFolder dnof True
ResourceType rt Microsoft.KeyVault/vaults
ResourceGroupNames rgns xxxxxxxxxx
ControlIds cids Azure_KeyVault_AuthZ_Grant_Min_Access_policies
ControlsToAttest cta All
AttestationStatus as NotAnIssue
JustificationText jt Quarterly check
You can also use: grs -s xxxxxxxxxxxxxxxxx -dnof -rt Microsoft.KeyVault/vaults -rgns xxxxxxxx Azure_KeyVault_AuthZ_Grant_Min_Access_policies -cta All -as NotAnIssue -jt Quarterly check
================================================================================
Running AzSK cmdlet using security policy...
Number of resources: 1
Number of resources for which security controls will be evaluated: 1
================================================================================
Starting analysis: [FeatureName: KeyVault] [ResourceGroupName: xxxxxxxxx] [ResourceName: xxxxxxxxxx]
--------------------------------------------------------------------------------
Checking: [KeyVault]-[All Key Vault access policies must be defined with minimum required permissions to keys and secrets]
--------------------------------------------------------------------------------
Completed analysis: [FeatureName: KeyVault] [ResourceGroupName: xxxxxxxxxxxx] [ResourceName: xxxxxxxx]
================================================================================
Summary Total Verify
------- ----- ------
High 1 1
------ ------ ------
Total 1 1
------ ------ ------
================================================================================
** Next steps **
Look at the individual control evaluation status in the CSV file.
a) If the control has passed, no action is necessary.
b) If the control has failed, look at the control evaluation detail in the LOG file to understand why.
c) If the control status says 'Verify', it means that human judgement is required to determine the final control stat
us. Look at the control evaluation output in the LOG file to make a determination.
d) If the control status says 'Manual', it means that AzSK (currently) does not cover the control via automation OR A
zSK is not able to fetch the data. You need to manually implement/verify it.
Note: The 'Recommendation' column in the CSV file provides basic (generic) guidance that can help you fix a failed control. Y
ou can also use standard Azure product documentation. You should carefully consider the implications of making the required c
hange in the context of your application.
Control results may not reflect attestation if you do not have permissions to read attestation data from AzSKRG
--------------------------------------------------------------------------------
Status and detailed logs have been exported to path - C:\Users\xxxxxxxx\AppData\Local\Microsoft\AzSKLogs\xxxxxxxx\20181218_171945_GRS\
================================================================================
################################################################################
Starting Control Attestation workflow in bulk mode...
--------------------------------------------------------------------------------
Warning:
Please use utmost discretion when attesting controls. In particular, when choosing to not fix a failing control, you are taki
ng accountability that nothing will go wrong even though security is not correctly/fully configured.
Also, please ensure that you provide an apt justification for each attested control to capture the rationale behind your deci
sion.
Do you want to continue (Y/N): Y
--------------------------------------------------------------------------------
No. of candidate resources for the attestation: 1
================================================================================
Info: Starting attestation [1/1]- [FeatureName: KeyVault] [ResourceGroupName: xxxxxx] [ResourceName: xxxxxxxx]
--------------------------------------------------------------------------------
No. of controls that need to be attested: 1
--------------------------------------------------------------------------------
ControlId : Azure_KeyVault_AuthZ_Grant_Min_Access_policies
ControlSeverity : High
Description : All Key Vault access policies must be defined with minimum required permissions to keys and secrets
CurrentControlStatus : Verify
--------------------------------------------------------------------------------
Attestation summary for this resource:
ControlId EvaluatedResult EffectiveResult AttestationChoice
--------- --------------- --------------- -----------------
Azure_KeyVault_AuthZ_Grant_Min_Access_policies Verify Passed NotAnIssue
Committing the attestation details for this resource...
Commit succeeded.
--------------------------------------------------------------------------------
Completed attestation: [FeatureName: KeyVault] [ResourceGroupName: xxxxxxx] [ResourceName: xxxxxx]
`` `
Что касается контрольных идентификаторов управления API, я заглянул внутрь папки моего модуля powershell внутри C:\Program Files\WindowsPowerShell\Modules\AzSK\3.8.0\Framework\Configurations\SVT\Services И искалидентификаторы элементов управления в файле apimanagement.json Но они не могут быть найдены в файлах json. Возможно, внутри модуля powershell этих элементов управления нет, а внутри задачи azsk конвейера они есть.