动手实验室 — AZ-500 Microsoft Azure Security Engineer Associate

概述

先决条件

步骤

1. 1.提供商、资源组、命名

   标准 Azure 开场白。

   复制

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
       random  = { source = "hashicorp/random",  version = "~> 3.6" }
     }
   }
   
   provider "azurerm" {
     features {
       key_vault {
         purge_soft_delete_on_destroy = true
       }
     }
   }
   
   resource "random_id" "suffix" {
     byte_length = 3
   }
   
   data "azurerm_client_config" "current" {}
   data "azurerm_subscription" "current" {}
   
   locals {
     tags = {
       Project   = "certlabpro-az-500"
       ManagedBy = "terraform"
     }
   }
   
   resource "azurerm_resource_group" "main" {
     name     = "certlabpro-az-500-rg"
     location = "eastus"
     tags     = local.tags
   }

2. 2.使用客户管理加密密钥构建 Key Vault

   配置服务：

   • Azure Key Vault

   客户管理密钥 (CMK) 是 AZ-500 数据安全 的基本要素：你提供并轮换加密密钥，Azure 存储/SQL 等服务使用它进行信封加密。与 Microsoft 管理密钥 (MMK) 相比 — MMK 更简单，但密钥由 Microsoft 持有。

   我们创建一个启用 RBAC 授权的 Key Vault，然后在其中创建一个 2048 位 RSA 密钥。步骤 3 中的存储帐户将引用此密钥进行静态加密。AZ-500 的 实施平台保护 和 管理安全操作 领域都将此 CMK 模式作为“组织控制密钥”问题中的静态加密解决方案。

   复制

   resource "azurerm_key_vault" "main" {
     name                       = "kv-az500-${random_id.suffix.hex}"
     resource_group_name        = azurerm_resource_group.main.name
     location                   = azurerm_resource_group.main.location
     tenant_id                  = data.azurerm_client_config.current.tenant_id
     sku_name                   = "standard"
     enable_rbac_authorization  = true
     soft_delete_retention_days = 7
     purge_protection_enabled   = false # set true in production
   
     tags = local.tags
   }
   
   resource "azurerm_role_assignment" "kv_admin_self" {
     scope                = azurerm_key_vault.main.id
     role_definition_name = "Key Vault Administrator"
     principal_id         = data.azurerm_client_config.current.object_id
   }
   
   resource "azurerm_key_vault_key" "cmk" {
     name         = "storage-cmk"
     key_vault_id = azurerm_key_vault.main.id
     key_type     = "RSA"
     key_size     = 2048
     key_opts     = ["unwrapKey", "wrapKey"]
   
     depends_on = [azurerm_role_assignment.kv_admin_self]
   
     rotation_policy {
       automatic {
         time_before_expiry = "P30D"
       }
       expire_after         = "P365D"
       notify_before_expiry = "P30D"
     }
   }

3. 3.创建 CMK 加密的存储帐户

   配置服务：

   • Azure Storage

   使用客户管理密钥的存储帐户需要一个用户分配的标识才能从 Key Vault 读取密钥。我们创建该标识，授予它 Key Vault 上的 Key Vault Crypto Service Encryption User 角色，然后通过 customer_managed_key 块将其绑定到存储帐户。

   key_versionless 模式（使用 customer_managed_key.key_vault_key_id = key_vault_key.cmk.versionless_id）是 AZ-500 自动密钥轮换的最佳实践：当密钥轮换时，存储帐户会自动获取新版本，无需手动重新配置。

   复制

   resource "azurerm_user_assigned_identity" "storage_cmk" {
     name                = "uami-az500-storage"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
   
     tags = local.tags
   }
   
   resource "azurerm_role_assignment" "storage_kv_user" {
     scope                = azurerm_key_vault.main.id
     role_definition_name = "Key Vault Crypto Service Encryption User"
     principal_id         = azurerm_user_assigned_identity.storage_cmk.principal_id
   }
   
   resource "azurerm_storage_account" "data" {
     name                            = "az500data${random_id.suffix.hex}"
     resource_group_name             = azurerm_resource_group.main.name
     location                        = azurerm_resource_group.main.location
     account_tier                    = "Standard"
     account_replication_type        = "LRS"
     account_kind                    = "StorageV2"
   
     https_traffic_only_enabled      = true
     min_tls_version                 = "TLS1_2"
     allow_nested_items_to_be_public = false
   
     identity {
       type         = "UserAssigned"
       identity_ids = [azurerm_user_assigned_identity.storage_cmk.id]
     }
   
     customer_managed_key {
       key_vault_key_id          = azurerm_key_vault_key.cmk.versionless_id
       user_assigned_identity_id = azurerm_user_assigned_identity.storage_cmk.id
     }
   
     tags = local.tags
   
     depends_on = [azurerm_role_assignment.storage_kv_user]
   }

4. 4.将 NSG 流日志设置为输出到 Log Analytics 工作区

   配置服务：

   • Azure Network Watcher
   • Azure Monitor

   NSG 流日志是 AZ-500 管理安全操作 中用于网络流量可见性的基本要素 — 它们记录 NSG 规则接受或拒绝的每个流（5 元组 + 字节 + 数据包 + 结果），并持久化到存储帐户，通过 Log Analytics 上的流量分析进行查询。

   我们预置 NSG、一个网络观察程序（拥有流日志终结点的区域 Azure 托管服务）以及一个启用流量分析的流日志资源。流日志存储在一个存储帐户中（与我们的数据存储分开），并处理到 Log Analytics 中以进行 KQL 查询。

   复制

   resource "azurerm_network_security_group" "main" {
     name                = "nsg-az500"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
   
     tags = local.tags
   }
   
   resource "azurerm_network_watcher" "main" {
     name                = "nw-az500"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
   
     tags = local.tags
   }
   
   resource "azurerm_storage_account" "flow_logs" {
     name                            = "az500flow${random_id.suffix.hex}"
     resource_group_name             = azurerm_resource_group.main.name
     location                        = azurerm_resource_group.main.location
     account_tier                    = "Standard"
     account_replication_type        = "LRS"
     account_kind                    = "StorageV2"
   
     https_traffic_only_enabled      = true
     min_tls_version                 = "TLS1_2"
     allow_nested_items_to_be_public = false
   
     tags = local.tags
   }
   
   resource "azurerm_log_analytics_workspace" "main" {
     name                = "log-az500"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
     sku                 = "PerGB2018"
     retention_in_days   = 30
   
     tags = local.tags
   }
   
   resource "azurerm_network_watcher_flow_log" "main" {
     name                 = "nsg-az500-flow"
     network_watcher_name = azurerm_network_watcher.main.name
     resource_group_name  = azurerm_resource_group.main.name
     target_resource_id   = azurerm_network_security_group.main.id
     storage_account_id   = azurerm_storage_account.flow_logs.id
     enabled              = true
     version              = 2
   
     retention_policy {
       enabled = true
       days    = 30
     }
   
     traffic_analytics {
       enabled               = true
       workspace_id          = azurerm_log_analytics_workspace.main.workspace_id
       workspace_region      = azurerm_log_analytics_workspace.main.location
       workspace_resource_id = azurerm_log_analytics_workspace.main.id
       interval_in_minutes   = 10
     }
   }

5. 5.在订阅范围启用 Microsoft Defender for Cloud 基础版 CSPM

   配置服务：

   • Microsoft Defender for Cloud

   Defender for Cloud 是 Azure 的 CSPM（云安全状况管理）和 CWP（云工作负载保护）服务。基础版 CSPM 层是免费的，包括 Microsoft 云安全基准评估 — Azure 将 CIS / NIST 控制转换为自动化检查。AZ-500 的 管理安全操作 领域将此基线作为开箱即用的安全可见性基础要素进行测试。

   我们启用基础版订阅范围定价计划（免费）和一个 auto_provisioning_setting，它会自动在新 VM 上挂接 Log Analytics 代理 — 这意味着此订阅中的新计算资源无需手动安装即可获得可观察性。付费的 Defender 计划（Defender for Servers、Defender for Storage、Defender for SQL 等）分别启用每资源类型的检测；我们为了成本考虑在此处将其禁用，但将其作为后续问题提及。

   随着这最后一部分的到位，AZ-500 基线已成形：静态 CMK 加密、网络流可见性、安全态势管理。每个额外的 AZ-500 模式（Sentinel、条件访问、私有终结点、Azure 防火墙）都将附加到此基础之上。

   复制

   resource "azurerm_security_center_subscription_pricing" "cspm" {
     tier          = "Free" # Foundational CSPM
     resource_type = "CloudPosture"
   }
   
   # Optional uncomment to enable paid Defender plans (each charges per resource).
   # resource "azurerm_security_center_subscription_pricing" "servers" {
   #   tier          = "Standard"
   #   resource_type = "VirtualMachines"
   #   subplan       = "P2"
   # }

清理