From 687b0398159418e72cec1f4e5695e80f7324d677 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kim=20Harjam=C3=A4ki?= Date: Mon, 6 Jul 2026 20:09:54 +0300 Subject: [PATCH 1/2] fix(bicep): enable use-recent-api-versions and pin four stale resource API versions - bicepconfig.json: flip use-recent-api-versions from off to warning - identity.bicep: userAssignedIdentities 2023-01-31 -> 2024-11-30 - logging-siem.bicep: workspaces 2023-09-01 -> 2025-02-01 - network-hubspoke.bicep: networkSecurityGroups + virtualNetworks 2024-05-01 -> 2024-10-01 - policy-assignments.bicep: policyAssignments 2024-04-01 -> 2025-01-01 (enforcementMode untouched) Closes Phase 33 P2 item for cloud-security-service-model. Verified via az bicep build/lint on every touched module plus a full-template pass on main.bicep and a regression check on the untouched keyvault.bicep module. --- bicepconfig.json | 2 +- impl/azure/landing-zone/bicep/modules/identity.bicep | 2 +- impl/azure/landing-zone/bicep/modules/logging-siem.bicep | 2 +- impl/azure/landing-zone/bicep/modules/network-hubspoke.bicep | 4 ++-- .../azure/landing-zone/bicep/modules/policy-assignments.bicep | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/bicepconfig.json b/bicepconfig.json index 7b7be46..95386d2 100644 --- a/bicepconfig.json +++ b/bicepconfig.json @@ -33,7 +33,7 @@ "simplify-interpolation": { "level": "warning" }, "simplify-json-null": { "level": "warning" }, "use-parent-property": { "level": "warning" }, - "use-recent-api-versions": { "level": "off" }, + "use-recent-api-versions": { "level": "warning" }, "use-resource-id-functions": { "level": "warning" }, "use-resource-symbol-reference": { "level": "warning" }, "use-safe-access": { "level": "warning" }, diff --git a/impl/azure/landing-zone/bicep/modules/identity.bicep b/impl/azure/landing-zone/bicep/modules/identity.bicep index 26a26ef..becd986 100644 --- a/impl/azure/landing-zone/bicep/modules/identity.bicep +++ b/impl/azure/landing-zone/bicep/modules/identity.bicep @@ -1,7 +1,7 @@ param location string param name string -resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { +resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' = { name: name location: location tags: { diff --git a/impl/azure/landing-zone/bicep/modules/logging-siem.bicep b/impl/azure/landing-zone/bicep/modules/logging-siem.bicep index f210409..20ce5f1 100644 --- a/impl/azure/landing-zone/bicep/modules/logging-siem.bicep +++ b/impl/azure/landing-zone/bicep/modules/logging-siem.bicep @@ -1,7 +1,7 @@ param location string param name string -resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = { +resource workspace 'Microsoft.OperationalInsights/workspaces@2025-02-01' = { name: name location: location properties: { diff --git a/impl/azure/landing-zone/bicep/modules/network-hubspoke.bicep b/impl/azure/landing-zone/bicep/modules/network-hubspoke.bicep index 8b4ebae..b94e411 100644 --- a/impl/azure/landing-zone/bicep/modules/network-hubspoke.bicep +++ b/impl/azure/landing-zone/bicep/modules/network-hubspoke.bicep @@ -1,7 +1,7 @@ param location string param name string -resource nsg 'Microsoft.Network/networkSecurityGroups@2024-05-01' = { +resource nsg 'Microsoft.Network/networkSecurityGroups@2024-10-01' = { name: '${name}-nsg' location: location properties: { @@ -23,7 +23,7 @@ resource nsg 'Microsoft.Network/networkSecurityGroups@2024-05-01' = { } } -resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-05-01' = { +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-10-01' = { name: name location: location properties: { diff --git a/impl/azure/landing-zone/bicep/modules/policy-assignments.bicep b/impl/azure/landing-zone/bicep/modules/policy-assignments.bicep index 635ce08..0e365d0 100644 --- a/impl/azure/landing-zone/bicep/modules/policy-assignments.bicep +++ b/impl/azure/landing-zone/bicep/modules/policy-assignments.bicep @@ -1,6 +1,6 @@ param location string -resource allowedLocations 'Microsoft.Authorization/policyAssignments@2024-04-01' = { +resource allowedLocations 'Microsoft.Authorization/policyAssignments@2025-01-01' = { name: guid(resourceGroup().id, 'allowed-locations') properties: { displayName: 'Allowed locations for the reference resource group' From 321e74894e8254d357d993b54b3c49f02abf0ee8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kim=20Harjam=C3=A4ki?= Date: Mon, 6 Jul 2026 20:10:02 +0300 Subject: [PATCH 2/2] docs(adr): record DoNotEnforce policy assignment decision as ADR-001 Reaffirms enforcementMode: DoNotEnforce on the allowed-locations policy assignment in impl/azure/landing-zone/bicep/modules/policy-assignments.bicep is an intentional, reviewed decision (stub/reference landing zone, not a deployed environment) rather than an unreviewed gap. Closes Phase 33 P4 item for cloud-security-service-model. --- .../001-policy-assignment-enforcement-mode.md | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 docs/adr/001-policy-assignment-enforcement-mode.md diff --git a/docs/adr/001-policy-assignment-enforcement-mode.md b/docs/adr/001-policy-assignment-enforcement-mode.md new file mode 100644 index 0000000..21c295c --- /dev/null +++ b/docs/adr/001-policy-assignment-enforcement-mode.md @@ -0,0 +1,49 @@ +# ADR 001: Policy Assignment Enforcement Mode (DoNotEnforce) + +## Status + +Accepted + +## Context + +The `impl/azure/landing-zone/bicep/modules/policy-assignments.bicep` module assigns the +built-in "Allowed locations" policy definition +(`e56962a6-4747-49cd-b67b-bf8b01975c4c`) with `enforcementMode: 'DoNotEnforce'` and +`metadata.rolloutState: 'audit'`. Phase 33 (Azure Infra Hardening) reviewed this setting +to confirm it is an intentional design choice rather than an unreviewed gap. + +The `impl/azure/landing-zone/` directory is explicitly documented (see its own README) as +an "Azure Landing Zone (Stub)" — a reference implementation demonstrating the pattern of +identity, network, logging, Key Vault, and policy modules working together, not a +deployed environment bound to any real subscription, management group, or workload. + +## Decision + +Keep `enforcementMode: 'DoNotEnforce'` (audit-only) for the `allowedLocations` policy +assignment in this stub landing zone. Do not flip to `Default` (enforcing) mode as part +of Phase 33. + +This is a deliberate, reviewed exception, not an oversight: enforcing mode on a reference +module (a) misrepresents a teaching/example artifact as hardened production guidance, and +(b) an enforcement-mode change is a live-policy behavior change that this phase's +constraints (no `az deployment`, validation via `bicep build`/`bicep lint` only) cannot +safely verify end-to-end before merge. + +## Consequences + +- Any team copying this stub landing zone into a real subscription MUST explicitly + revisit `enforcementMode` and set it to `Default` (or remove `DoNotEnforce` entirely) + before treating the copied module as a production control. This ADR is the durable + record of that follow-up obligation. +- No immediate change to deployed infrastructure results from this ADR, because this + module has never been deployed as production infrastructure (stub/reference only). +- If this landing zone stub is ever promoted to an actively deployed reference + environment (e.g. a real demo subscription), enforcement mode must be reassessed at + that time and this ADR superseded by a new one recording that transition. + +## Related + +- `impl/azure/landing-zone/bicep/modules/policy-assignments.bicep` +- `impl/azure/landing-zone/README.md` +- Phase 33 context: `.planning/phases/33-azure-infra-hardening/33-CONTEXT.md` (in the + `PersonalRepo` root workspace, not this repository)