| JSON |
{
"properties": {
"displayName": "[Preview]: Configure supported Windows virtual machines to automatically install the Guest Attestation extension",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Configure supported Windows virtual machines to automatically install the Guest Attestation extension to allow Azure Security Center to proactively attest and monitor the boot integrity. Boot integrity is attested via Remote Attestation.",
"metadata": {
"category": "Security Center",
"version": "1.0.0-preview",
"preview": true
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.offer",
"like": "windows*"
},
{
"field": "Microsoft.Compute/virtualMachines/securityProfile.uefiSettings",
"exists": "true"
},
{
"field": "Microsoft.Compute/virtualMachines/securityProfile.uefiSettings.vTpmEnabled",
"equals": "true"
},
{
"field": "Microsoft.Compute/virtualMachines/securityProfile.uefiSettings.secureBootEnabled",
"equals": "true"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Compute/virtualMachines/extensions",
"existenceCondition": {
"allOf": [
{
"field": "Microsoft.Compute/virtualMachines/extensions/publisher",
"equals": "Microsoft.Azure.Security.WindowsAttestation"
},
{
"field": "Microsoft.Compute/virtualMachines/extensions/type",
"equals": "GuestAttestation"
},
{
"field": "Microsoft.Compute/virtualMachines/extensions/provisioningState",
"in": [
"Succeeded",
"Provisioning succeeded"
]
}
]
},
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
],
"deployment": {
"properties": {
"mode": "incremental",
"parameters": {
"vmName": {
"value": "[field('name')]"
},
"location": {
"value": "[field('location')]"
}
},
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string"
},
"location": {
"type": "string"
}
},
"variables": {
"extensionName": "GuestAttestation",
"extensionPublisher": "Microsoft.Azure.Security.WindowsAttestation",
"extensionVersion": "1.0",
"maaTenantName": "GuestAttestation",
"ascReportingEndpoint": "https://eus2.service.attest.azure.net/",
"maaEndpoint": "https://sharedeus2.eus2.attest.azure.net/"
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2018-10-01",
"name": "[concat(parameters('vmName'), '/', variables('extensionName'))]",
"location": "[parameters('location')]",
"properties": {
"publisher": "[variables('extensionPublisher')]",
"type": "[variables('extensionName')]",
"typeHandlerVersion": "[variables('extensionVersion')]",
"autoUpgradeMinorVersion": true,
"settings": {
"AttestationConfig": {
"MaaSettings": {
"maaEndpoint": "[variables('maaEndpoint')]",
"maaTenantName": "[variables('maaTenantName')]"
},
"AscSettings": {
"ascReportingEndpoint": "[variables('ascReportingEndpoint')]",
"ascReportingFrequency": ""
},
"useCustomToken": "false",
"disableAlerts": "false"
}
}
}
}
]
}
}
}
}
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/98ea2fc7-6fc6-4fd1-9d8d-6331154da071",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "98ea2fc7-6fc6-4fd1-9d8d-6331154da071"
}
|