Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenAI Policies #376

Merged
merged 2 commits into from
Aug 11, 2023
Merged

OpenAI Policies #376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c3e5f56
adding policy files
sarajoshi Jul 5, 2023
6ea4246
removing dsstore
sarajoshi Jul 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions policyDefinitions/Cognitive Services/audit-content-logging/azurepolicy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
{
"name": "5e68f029-0f81-4ee3-b578-705b0fdb237d",
"type": "Microsoft.Authorization/policyDefinitions",
"properties": {
"displayName": "Audit OpenAI instances with content filtering enabled",
"description": "Azure OpenAI Service includes a content management system that filters content. If you are working with sensitive data, content filtering should be disabled so that Microsoft is not processing your data.",
"metadata": {
"category": "Cognitive Services",
"version": "1.0.0"
},
"mode": "Indexed",
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts"
},
{
"field": "kind",
"equals": "OpenAI"
},
{
"anyOf": [
{
"field": "Microsoft.CognitiveServices/accounts/capabilities[*].name",
"notEquals": "ContentLogging"
}
]
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
}
}
15 changes: 15 additions & 0 deletions policyDefinitions/Cognitive Services/audit-content-logging/azurepolicy.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
}
25 changes: 25 additions & 0 deletions policyDefinitions/Cognitive Services/audit-content-logging/azurepolicy.rules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts"
},
{
"field": "kind",
"equals": "OpenAI"
},
{
"anyOf": [
{
"field": "Microsoft.CognitiveServices/accounts/capabilities[*].name",
"notEquals": "ContentLogging"
}
]
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
73 changes: 73 additions & 0 deletions policyDefinitions/Cognitive Services/public-access-restriction/azurepolicy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
{
"name": "5e68f029-0f81-4ee3-b578-705b0fdb237c",
"type": "Microsoft.Authorization/policyDefinitions",
"properties": {
"displayName": "Audit OpenAI instances public access enabled",
"description": "Azure OpenAI instances should not have public access enabled. Open AI instances should only be accessible via select networks or a private endpoint.",
"metadata": {
"category": "Cognitive Services",
"version": "1.0.0"
},
"mode": "Indexed",
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts"
},
{
"field": "kind",
"equals": "OpenAI"
},
{
"anyof": [
{
"allof": [
{
"field": "Microsoft.CognitiveServices/accounts/networkAcls.defaultAction",
"notEquals": "Deny"
},
{
"field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
"equals": "Enabled"
}
]
},
{
"allof": [
{
"field": "Microsoft.CognitiveServices/accounts/networkAcls",
"exists": "false"
},
{
"field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
"equals": "Enabled"
}
]
}
]
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
}
}
15 changes: 15 additions & 0 deletions policyDefinitions/Cognitive Services/public-access-restriction/azurepolicy.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
}
45 changes: 45 additions & 0 deletions policyDefinitions/Cognitive Services/public-access-restriction/azurepolicy.rules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts"
},
{
"field": "kind",
"equals": "OpenAI"
},
{
"anyof": [
{
"allof": [
{
"field": "Microsoft.CognitiveServices/accounts/networkAcls.defaultAction",
"notEquals": "Deny"
},
{
"field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
"equals": "Enabled"
}
]
},
{
"allof": [
{
"field": "Microsoft.CognitiveServices/accounts/networkAcls",
"exists": "false"
},
{
"field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
"equals": "Enabled"
}
]
}
]
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}