Update Deploy-Private-DNS-Zones - add DINE SqlServer PrivateDNSZone

docs/wiki/Whats-new.md

@@ -58,6 +58,9 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
 
 - Updated the ***Baseline alerts and monitoring*** integration section in the portal accelerator to deploy the latest release of AMBA (2025-02-05). To read more on the changes, see the [What's new](https://aka.ms/amba/alz/whatsnew) page in the AMBA documentation.
 
+#### Other
+- Azure Policy Initative for Private DNS Zone updated to include SQL Server private dns zone. A new policy definition is also included as we waith for the auzre policy built-in policy PR to be approved and merged. [Built-In Policy PR](https://github.com/Azure/azure-policy/pull/1418)
+
 ### January 2025
 
 #### Tooling

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-SqlServer-PrivateDNSZone.json

@@ -0,0 +1,119 @@
+{
+  "properties": {
+    "displayName": "Configure a private DNS Zone ID for SQL Server",
+    "policyType": "BuiltIn",
+    "mode": "Indexed",
+    "description": "Configure private DNS zone group to override the DNS resolution for a SQL Server private endpoint.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "SQL"
+    },
+    "version": "1.0.0",
+    "parameters": {
+      "privateDnsZoneId": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Configure a private DNS Zone ID for SQL Server",
+          "description": "Configure private DNS zone group to override the DNS resolution for a SQL Server private endpoint.",
+          "strongType": "Microsoft.Network/privateDnsZones",
+          "assignPermissions": true
+        }
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "DeployIfNotExists",
+          "Disabled"
+        ],
+        "defaultValue": "DeployIfNotExists"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [
+          {
+            "field": "type",
+            "equals": "Microsoft.Network/privateEndpoints"
+          },
+          {
+            "count": {
+              "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
+              "where": {
+                "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
+                "equals": "sqlServer"
+              }
+            },
+            "greaterOrEquals": 1
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]",
+        "details": {
+          "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+          "roleDefinitionIds": [
+            "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
+          ],
+          "deployment": {
+            "properties": {
+              "mode": "incremental",
+              "template": {
+                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                "contentVersion": "1.0.0.0",
+                "parameters": {
+                  "privateDnsZoneId": {
+                    "type": "string"
+                  },
+                  "privateEndpointName": {
+                    "type": "string"
+                  },
+                  "location": {
+                    "type": "string"
+                  }
+                },
+                "resources": [
+                  {
+                    "name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
+                    "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                    "apiVersion": "2020-03-01",
+                    "location": "[parameters('location')]",
+                    "properties": {
+                      "privateDnsZoneConfigs": [
+                        {
+                          "name": "privateDnsZone",
+                          "properties": {
+                            "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
+                          }
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              "parameters": {
+                "privateDnsZoneId": {
+                  "value": "[parameters('privateDnsZoneId')]"
+                },
+                "privateEndpointName": {
+                  "value": "[field('name')]"
+                },
+                "location": {
+                  "value": "[field('location')]"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "versions": [
+      "1.0.0"
+    ]
+  },
+  "id": "/providers/Microsoft.Authorization/policyDefinitions/c27b8841-4270-4c95-9742-38f4fdb3fbb5",
+  "name": "c27b8841-4270-4c95-9742-38f4fdb3fbb5"
+}

src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json

@@ -8,7 +8,7 @@
     "displayName": "Configure Azure PaaS services to use private DNS zones",
     "description": "This policy initiative is a group of policies that ensures private endpoints to Azure PaaS services are integrated with Azure Private DNS zones",
     "metadata": {
-      "version": "2.4.0",
+      "version": "2.5.0",
       "category": "Network",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -52,63 +52,63 @@
         "type": "object",
         "defaultValue": {
           "changeme": "changeme",
-          "australiacentral" : "acl",
-          "australiacentral2" : "acl2",
-          "australiaeast" : "ae",
-          "australiasoutheast" : "ase",
-          "brazilsoutheast" : "bse",
-          "brazilsouth" : "brs",
-          "canadacentral" : "cnc",
-          "canadaeast" : "cne",
-          "centralindia" : "inc",
-          "centralus" : "cus",
-          "centraluseuap" : "ccy",
-          "chilecentral" : "clc",
-          "eastasia" : "ea",
-          "eastus" : "eus",
-          "eastus2" : "eus2",
-          "eastus2euap" : "ecy",
-          "francecentral" : "frc",
-          "francesouth" : "frs",
-          "germanynorth" : "gn",
-          "germanywestcentral" : "gwc",
-          "israelcentral" : "ilc",
-          "italynorth" : "itn",
-          "japaneast" : "jpe",
-          "japanwest" : "jpw",
-          "koreacentral" : "krc",
-          "koreasouth" : "krs",
-          "malaysiasouth" : "mys",
-          "malaysiawest" : "myw",
-          "mexicocentral" : "mxc",
-          "newzealandnorth" : "nzn",
-          "northcentralus" : "ncus",
-          "northeurope" : "ne",
-          "norwayeast" : "nwe",
-          "norwaywest" : "nww",
-          "polandcentral" : "plc",
-          "qatarcentral" : "qac",
-          "southafricanorth" : "san",
-          "southafricawest" : "saw",
-          "southcentralus" : "scus",
-          "southeastasia" : "sea",
-          "southindia" : "ins",
-          "spaincentral" : "spc",
-          "swedencentral" : "sdc",
-          "swedensouth" : "sds",
-          "switzerlandnorth" : "szn",
-          "switzerlandwest" : "szw",
-          "taiwannorth" : "twn",
-          "uaecentral" : "uac",
-          "uaenorth" : "uan",
-          "uksouth" : "uks",
-          "ukwest" : "ukw",
-          "westcentralus" : "wcus",
-          "westeurope" : "we",
-          "westindia" : "inw",
-          "westus" : "wus",
-          "westus2" : "wus2",
-          "westus3" : "wus3"
+          "australiacentral": "acl",
+          "australiacentral2": "acl2",
+          "australiaeast": "ae",
+          "australiasoutheast": "ase",
+          "brazilsoutheast": "bse",
+          "brazilsouth": "brs",
+          "canadacentral": "cnc",
+          "canadaeast": "cne",
+          "centralindia": "inc",
+          "centralus": "cus",
+          "centraluseuap": "ccy",
+          "chilecentral": "clc",
+          "eastasia": "ea",
+          "eastus": "eus",
+          "eastus2": "eus2",
+          "eastus2euap": "ecy",
+          "francecentral": "frc",
+          "francesouth": "frs",
+          "germanynorth": "gn",
+          "germanywestcentral": "gwc",
+          "israelcentral": "ilc",
+          "italynorth": "itn",
+          "japaneast": "jpe",
+          "japanwest": "jpw",
+          "koreacentral": "krc",
+          "koreasouth": "krs",
+          "malaysiasouth": "mys",
+          "malaysiawest": "myw",
+          "mexicocentral": "mxc",
+          "newzealandnorth": "nzn",
+          "northcentralus": "ncus",
+          "northeurope": "ne",
+          "norwayeast": "nwe",
+          "norwaywest": "nww",
+          "polandcentral": "plc",
+          "qatarcentral": "qac",
+          "southafricanorth": "san",
+          "southafricawest": "saw",
+          "southcentralus": "scus",
+          "southeastasia": "sea",
+          "southindia": "ins",
+          "spaincentral": "spc",
+          "swedencentral": "sdc",
+          "swedensouth": "sds",
+          "switzerlandnorth": "szn",
+          "switzerlandwest": "szw",
+          "taiwannorth": "twn",
+          "uaecentral": "uac",
+          "uaenorth": "uan",
+          "uksouth": "uks",
+          "ukwest": "ukw",
+          "westcentralus": "wcus",
+          "westeurope": "we",
+          "westindia": "inw",
+          "westus": "wus",
+          "westus2": "wus2",
+          "westus3": "wus3"
         },
         "metadata": {
           "displayName": "Region Short Name Mapping",
@@ -187,7 +187,8 @@
           "azureSynapseSQLODPrivateDnsZoneId": "privatelink.sql.azuresynapse.net",
           "azureVirtualDesktopHostpoolPrivateDnsZoneId": "privatelink.wvd.microsoft.com",
           "azureVirtualDesktopWorkspacePrivateDnsZoneId": "privatelink.wvd.microsoft.com",
-          "azureWebPrivateDnsZoneId": "privatelink.webpubsub.azure.com"
+          "azureWebPrivateDnsZoneId": "privatelink.webpubsub.azure.com",
+          "azureSqlServerPrivateDnsZoneId": "privatelink.database.windows.net"
         },
         "metadata": {
           "displayName": "DNS Zone Names",
@@ -1657,7 +1658,7 @@
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Arc",
         "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/55c4db33-97b0-437b-8469-c4f4498f5df9",
         "definitionVersion": "1.*.*",
-        "parameters":{
+        "parameters": {
           "privateDnsZoneIDForGuestConfiguration": {
             "value": "[[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureArcGuestconfigurationPrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureArcGuestconfigurationPrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
           },
@@ -1676,7 +1677,7 @@
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-IoTCentral",
         "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d627d7c6-ded5-481a-8f2e-7e16b1e6faf6",
         "definitionVersion": "1.*.*",
-        "parameters":{
+        "parameters": {
           "privateDnsZoneId": {
             "value": "[[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureIotCentralPrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureIotCentralPrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
           },
@@ -1689,7 +1690,7 @@
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Storage-Table",
         "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/028bbd88-e9b5-461f-9424-a1b63a7bee1a",
         "definitionVersion": "1.*.*",
-        "parameters":{
+        "parameters": {
           "privateDnsZoneId": {
             "value": "[[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureStorageTablePrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureStorageTablePrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
           },
@@ -1702,7 +1703,7 @@
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Storage-Table-Secondary",
         "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c1d634a5-f73d-4cdd-889f-2cc7006eb47f",
         "definitionVersion": "1.*.*",
-        "parameters":{
+        "parameters": {
           "privateDnsZoneId": {
             "value": "[[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureStorageTableSecondaryPrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureStorageTableSecondaryPrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
           },
@@ -1713,9 +1714,9 @@
       },
       {
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Site-Recovery-Backup",
-        "policyDefinitionId":"/providers/Microsoft.Authorization/policyDefinitions/af783da1-4ad1-42be-800d-d19c70038820",
+        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af783da1-4ad1-42be-800d-d19c70038820",
         "definitionVersion": "1.*.*-preview",
-        "parameters":{
+        "parameters": {
           "privateDnsZone-Backup": {
             "value": "[[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureSiteRecoveryBackupPrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureSiteRecoveryBackupPrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
           },
@@ -1729,8 +1730,21 @@
             "value": "[[parameters('effect')]"
           }
         }
+      },
+      {
+        "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-SQL-Server",
+        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c27b8841-4270-4c95-9742-38f4fdb3fbb5",
+        "definitionVersion": "1.*.*",
+        "parameters": {
+          "privateDnsZoneId": {
+            "value": "[if(equals(parameters('dnsZoneSubscriptionId'), ''), parameters('azureSqlServerPrivateDnsZoneId'), format('/subscriptions/{0}/resourceGroups/{1}/providers/{2}/{3}', parameters('dnsZoneSubscriptionId'), toLower(parameters('dnsZoneResourceGroupName')), parameters('dnsZoneResourceType'), replace(replace(parameters('dnsZoneNames').azureSqlServerPrivateDnsZoneId, '{regionName}', parameters('dnsZoneRegion')), '{regionCode}', parameters('dnzZoneRegionShortNames')[parameters('dnsZoneRegion')])))]"
+          },
+          "effect": {
+            "value": "[parameters('effect')]"
+          }
+        }
       }
     ],
     "policyDefinitionGroups": null
   }
-}
+}