AzPolicyAdvertizer

last sync: 2025-Sep-18 17:23:10 UTC

CORS should not allow every domain to access your FHIR Service

Azure BuiltIn Policy definition

-Source
+ Azure Portal
-Display name
+CORS should not allow every domain to access your FHIR Service
-Id
+                        fe1c9040-c46a-4e81-9aea-c7850fbb3aa6
-Version
+.1.0
  Details on versioning
-Versioning
+                        Versions supported for Versioning: 1
1.1.0
                         Built-in Versioning [Preview]
-Category
+Healthcare APIs
 Microsoft Learn
-Description
+Cross-Origin Resource Sharing (CORS) should not allow all domains to access your FHIR Service. To protect your FHIR Service, remove access for all domains and explicitly define the domains allowed to connect.
-Cloud environments
+AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown
-Available in AzUSGov
+Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
-Mode
+Indexed
-Type
+BuiltIn
-Preview
+                False
-Deprecated
+False
-Effect
+                Default
Audit

                Allowed
audit, Audit, disabled, Disabled
-RBAC role(s)
+                            none
-Rule aliases
+IF (1)


                    
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                            
                                Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]
                                Microsoft.HealthcareApis
                                workspaces/fhirservices
                                properties.corsConfiguration.origins[*]
                                True
                                
                                False
-Alias
+Modifiable
-Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]
+False
-Rule resource types
+                IF (1)

                                    Microsoft.HealthcareApis/workspaces/fhirservices
-Compliance
+                    Not a Compliance control
-Initiatives usage
+                none
-History
+                                Date/Time (UTC ymd) (i)
                                Change type
                                Change detail
                            
                                                    
                                2022-04-01 20:29:14
                                change
                                Minor (1.0.0 > 1.1.0)
                            
                            
                                2021-09-08 15:39:57
                                add
                                fe1c9040-c46a-4e81-9aea-c7850fbb3aa6
-Date/Time (UTC ymd) (i)
+Change detail
--04-01 20:29:14
+Minor (1.0.0 > 1.1.0)
--09-08 15:39:57
+fe1c9040-c46a-4e81-9aea-c7850fbb3aa6
-JSON compare
+    "policyType": "BuiltIn",
@@ -3,9 +3,9 @@
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your FHIR Service. To protect your FHIR Service, remove access for all domains and explicitly define the domains allowed to connect.",
     "metadata": {
-        "version": "1.0.0",
         "category": "Healthcare APIs"
     },
     "parameters": {
         "effect": {
@@ -15,11 +15,13 @@
                 "description": "Enable or disable the execution of the policy"
             },
             "allowedValues": [
                 "audit",
-                "disabled"
             ],
-            "defaultValue": "audit"
         }
     },
     "policyRule": {
         "if": {
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your FHIR Service. To protect your FHIR Service, remove access for all domains and explicitly define the domains allowed to connect.",
     "metadata": {
+        "version": "1.1.0",
         "category": "Healthcare APIs"
     },
     "parameters": {
         "effect": {
                 "description": "Enable or disable the execution of the policy"
             },
             "allowedValues": [
                 "audit",
+                "Audit",
+                "disabled",
+                "Disabled"
             ],
+            "defaultValue": "Audit"
         }
     },
     "policyRule": {
         "if": {
-JSON
+                                api-version=2021-06-01

                                  EPAC
                                
                            
                        
                        
                            
                                {7 itemsdisplayName: "CORS should not allow every domain to access your FHIR Service",
policyType: "BuiltIn",
mode: "Indexed",
description: "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your FHIR Service. To protect your FHIR Service, remove access for all domains and explicitly define the domains allowed to connect.",
metadata: {2 itemsversion: "1.1.0",
category: "Healthcare APIs"
},
parameters: {1 itemeffect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of the policy"
},
allowedValues: [4 items"audit",
"Audit",
"disabled",
"Disabled"
],
defaultValue: "Audit"
}
},
policyRule: {2 itemsif: {1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HealthcareApis/workspaces/fhirservices"
},
{2 itemscount: {2 itemsfield: "Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]",
where: {2 itemsfield: "Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]",
equals: "*"
}
},
greater: 0
}
]
},
then: {1 itemeffect: "[parameters('effect')]"
}
}
}
                                 api-version=2021-06-01

                                  EPAC
                                 {7 itemsdisplayName: "CORS should not allow every domain to access your FHIR Service",
policyType: "BuiltIn",
mode: "Indexed",
description: "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your FHIR Service. To protect your FHIR Service, remove access for all domains and explicitly define the domains allowed to connect.",
metadata: {2 itemsversion: "1.1.0",
category: "Healthcare APIs"
},
parameters: {1 itemeffect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of the policy"
},
allowedValues: [4 items"audit",
"Audit",
"disabled",
"Disabled"
],
defaultValue: "Audit"
}
},
policyRule: {2 itemsif: {1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HealthcareApis/workspaces/fhirservices"
},
{2 itemscount: {2 itemsfield: "Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]",
where: {2 itemsfield: "Microsoft.HealthcareApis/workspaces/fhirservices/corsConfiguration.origins[*]",
equals: "*"
}
},
greater: 0
}
]
},
then: {1 itemeffect: "[parameters('effect')]"
}
}
}