### Azure Resource Graph Query Example in JSON Schema

Source: https://context7.com/azure/review-checklists/llms.txt

This snippet illustrates the structure of a checklist item, including an example Azure Resource Graph query to automatically verify compliance for AKS availability zones. The schema defines categories, subcategories, severity, and links to documentation.

```json
{
    "items": [
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Use Availability Zones if they are supported in your Azure region",
            "waf": "Reliability",
            "service": "AKS",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "id": "02.02.02",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/availability-zones",
            "training": "https://learn.microsoft.com/training/modules/",
            "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant"
        }
    ],
    "metadata": {
        "name": "AKS Review Checklist",
        "state": "GA",
        "timestamp": "2024-01-15"
    }
}
```

--------------------------------

### Import Azure Resource Graph Results to Excel

Source: https://context7.com/azure/review-checklists/llms.txt

This guide explains how to import Azure Resource Graph query results into an Excel spreadsheet for tracking compliance. It involves generating JSON results using a script, then using Excel's import features to load the data. The expected JSON output format includes a GUID, text description, and an array of results with resource IDs and compliance status.

```bash
# Generate JSON results for import
./checklist_graph.sh --technology=aks --format=json > aks_graph_results.json

# In Excel spreadsheet:
# 1. Load the AKS checklist using "Import latest checklist" button
# 2. Click "Import Graph Results" in the Advanced section
# 3. Select the generated aks_graph_results.json file
# 4. Results populate in the "Comments" column showing compliant/non-compliant resources
```

```json
# Example output format in JSON:
{
  "guid": "578a219a-46be-4b54-9350-24922634292b",
  "text": "Use Availability Zones if supported in your Azure region",
  "results": [
    {
      "id": "/subscriptions/.../resourceGroups/myRG/providers/Microsoft.ContainerService/managedClusters/myAKS",
      "compliant": false
    }
  ]
}
```

--------------------------------

### Add New Checklist Item to AKS Checklist (JSON)

Source: https://context7.com/azure/review-checklists/llms.txt

This snippet demonstrates how to add a new recommendation to the AKS checklist by modifying the English JSON file. It includes required fields like category, subcategory, text, GUID, severity, and link, along with optional fields for Azure Resource Graph queries, training links, Well-Architected Framework pillars, and service names.

```json
{
    "category": "Security",
    "subcategory": "Network Security",
    "text": "Enable network policies to control pod-to-pod traffic",
    "waf": "Security",
    "service": "AKS",
    "guid": "12345678-1234-1234-1234-123456789abc",
    "id": "04.03.01",
    "severity": "High",
    "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
    "training": "https://learn.microsoft.com/training/modules/...",
    "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id, compliant"
}
```

--------------------------------

### Download and Make Executable: checklist_graph.sh

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

Downloads the `checklist_graph.sh` script using wget and makes it executable. This script requires a Bash environment and Azure CLI.

```Shell
wget -quiet -output-document=./checklist_graph.sh https://raw.githubusercontent.com/Azure/review-checklists/main/scripts/checklist_graph.sh
chmod +xr ./checklist_graph.sh
```

--------------------------------

### Download Excel Review Checklist with Bash

Source: https://context7.com/azure/review-checklists/llms.txt

This bash command downloads the latest macro-enabled Excel spreadsheet for interactive Azure design reviews from GitHub releases. An alternative method involves cloning the repository to access all related assets.

```bash
# Download the latest Excel spreadsheet from GitHub releases
curl -L -o review_checklist.xlsm \
  https://github.com/Azure/review-checklists/releases/latest/download/review_checklist.xlsm

# Alternative: Clone the repository for all assets
git clone https://github.com/Azure/review-checklists.git
cd review-checklists/spreadsheet

# The spreadsheet includes:
# - review_checklist.xlsm (macro-enabled for importing checklists)
# - review_checklists_scripts.xlsx (macro-free version)
```

--------------------------------

### Deploy Azure Monitor Workbooks using Azure CLI

Source: https://context7.com/azure/review-checklists/llms.txt

This section demonstrates how to deploy pre-built Azure Monitor Workbooks using the Azure CLI. These workbooks visualize compliance status based on Azure Resource Graph queries, providing interactive dashboards. Deployment requires specifying the resource group and the URI of the workbook template.

```bash
# Deploy Landing Zone Review Workbook via Azure CLI
az deployment group create \
  --resource-group myResourceGroup \
  --template-uri https://raw.githubusercontent.com/Azure/review-checklists/main/workbooks/alz_checklist.en_workbook_template.json \
  --parameters workbookDisplayName="Azure Landing Zone Review"
```

```bash
# Deploy AKS Review Workbook
az deployment group create \
  --resource-group myResourceGroup \
  --template-uri https://raw.githubusercontent.com/Azure/review-checklists/main/workbooks/aks_checklist.en_workbook_template.json \
  --parameters workbookDisplayName="AKS Review"
```

```bash
# Deploy Network App Delivery Workbook
az deployment group create \
  --resource-group myResourceGroup \
  --template-uri https://raw.githubusercontent.com/Azure/review-checklists/main/workbooks/network_appdelivery_checklist.en_workbook_template.json
```

--------------------------------

### Manual Azure Monitor Workbook Deployment

Source: https://context7.com/azure/review-checklists/llms.txt

This describes the manual process for deploying Azure Monitor Workbooks by copying workbook JSON content directly into the Azure Portal. It involves navigating to the Workbooks section, creating a new workbook using the Advanced Editor, pasting the JSON content, and applying the changes.

```text
# Manual deployment: Copy workbook JSON to Azure Monitor
# 1. Navigate to Azure Portal > Monitor > Workbooks
# 2. Click "New" > "Advanced Editor"
# 3. Paste contents from workbook JSON file (e.g., alz_checklist.en_workbook.json)
# 4. Click "Apply" to create the workbook
```

--------------------------------

### List Available Azure Checklists

Source: https://context7.com/azure/review-checklists/llms.txt

This section shows how to list the available checklist JSON files in the repository, categorized into main checklists and extended checklists. It also demonstrates how to check for available language translations for a specific checklist, with English being the source language.

```bash
# Main checklists (checklists/ directory)
ls checklists/*.en.json

# Outputs:
# aks_checklist.en.json      - Azure Kubernetes Service
# alz_checklist.en.json      - Azure Landing Zone
# avd_checklist.en.json      - Azure Virtual Desktop
# avs_checklist.en.json      - Azure VMware Solution
# sap_checklist.en.json      - SAP on Azure
# apim_checklist.en.json     - API Management
# aro_checklist.en.json      - Azure Red Hat OpenShift
# multitenancy_checklist.en.json
# network_appdelivery_checklist.en.json
# cost_checklist.en.json
# sql_checklist.en.json
# spring_checklist.en.json
```

```bash
# Extended checklists (checklists-ext/ directory)
# Generated from external sources like WAF Service Guides
ls checklists-ext/*.en.json
```

```bash
# Available languages per checklist
ls checklists/aks_checklist.*
# aks_checklist.en.json (English - source)
```

--------------------------------

### Run Azure Resource Graph Queries for AKS Checklist (JSON Output)

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

Executes Azure Resource Graph queries for the AKS checklist and outputs the results in JSON format to a file. This is useful for importing into spreadsheets.

```Shell
./checklist_graph.sh --technology=aks --format=json > ./graph_results.json
```

--------------------------------

### List Available Checklists

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

Lists all available checklists that can be processed by the `checklist_graph.sh` script. Not all checklists contain Azure Resource Graph queries.

```Shell
./checklist_graph.sh --list-technologies
```

--------------------------------

### Perform Review for All AKS Categories (Text Output)

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

Runs the review script for all categories within the AKS checklist and outputs the results in a human-readable text format. The output can be directly copy-pasted into spreadsheets.

```Shell
./checklist_graph.sh --technology=aks --format=text
```

--------------------------------

### Automate Azure Compliance Checks with Bash Script

Source: https://context7.com/azure/review-checklists/llms.txt

This bash script, `checklist_graph.sh`, automates Azure Resource Graph queries to verify compliance with checklist recommendations across subscriptions. It supports listing technologies, categories, and running checks in JSON or text format, with options for scoping to management groups and debugging.

```bash
# Download the script
wget -q -O ./checklist_graph.sh \
  https://raw.githubusercontent.com/Azure/review-checklists/main/scripts/checklist_graph.sh
chmod +x ./checklist_graph.sh

# List available checklists with Azure Resource Graph queries
./checklist_graph.sh --list-technologies
# Output:
# aks (87 queries)
# alz (142 queries)
# avd (34 queries)
# ...

# List categories in a specific checklist
./checklist_graph.sh --technology=aks --list-categories
# Output:
# 0: - Identity and Access Management
# 1: - Network Topology and Connectivity
# 2: - BC and DR
# 3: - Governance and Security
# 4: - Cost Governance
# 5: - Operations
# 6: - Application Deployment

# Run all checks and output JSON (for Excel import)
./checklist_graph.sh --technology=aks --format=json > graph_results.json

# Run checks with human-readable text output
./checklist_graph.sh --technology=aks --format=text

# Run checks for a specific category only
./checklist_graph.sh --technology=aks --category=2 --format=text

# Scope queries to a management group instead of subscription
./checklist_graph.sh --technology=aks --management-group=my-mgmt-group --format=json

# Debug mode for troubleshooting
./checklist_graph.sh --technology=aks --format=json --debug
```

--------------------------------

### Azure Resource Graph Queries for AKS, VNets, Gateways, Firewalls, and NSGs

Source: https://context7.com/azure/review-checklists/llms.txt

These Kusto queries are used with Azure Resource Graph to check compliance of various Azure resources. They evaluate configurations like Availability Zones for AKS, private IP ranges for VNets, SKU tiers for VPN/ExpressRoute gateways and Azure Firewalls, and NSG rule counts. The output includes resource IDs and a boolean indicating compliance.

```kusto
// Check if AKS clusters use Availability Zones
resources
| where type=='microsoft.containerservice/managedclusters'
| extend compliant = isnotnull(properties.agentPoolProfiles[0].availabilityZones)
| distinct id, compliant
```

```kusto
// Check if AKS clusters use the SLA-backed offering
resources
| where type=='microsoft.containerservice/managedclusters'
| extend compliant = (sku.tier=='Paid')
| distinct id, compliant
```

```kusto
// Check if VNets use RFC 1918 private IP ranges
resources
| where type == 'microsoft.network/virtualnetworks'
| extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes)
| mvexpand addressPrefix
| project name, id, cidr = addressPrefix
| extend compliant = (cidr matches regex @'^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)')
| project id, compliant, cidr
```

```kusto
// Check if VPN/ExpressRoute gateways are zone-redundant
resources
| where type == 'microsoft.network/virtualnetworkgateways'
| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'
| extend SKUTier = properties.sku.tier, Type = properties.gatewayType
| extend compliant = SKUTier contains 'AZ'
| project name, id, Type, compliant
```

```kusto
// Check if Azure Firewall uses Premium SKU
resources
| where type=='microsoft.network/firewallpolicies'
| extend compliant = (properties.sku.tier == 'Premium')
| distinct id, compliant
```

```kusto
// Check NSG rule counts (should be under 900)
resources
| where type == 'microsoft.network/networksecuritygroups'
| project id, rules = array_length(properties.securityRules)
| project id, compliant = (rules < 900)
```

--------------------------------

### Azure Resource Graph Query for AKS Network Policy Compliance (KQL)

Source: https://context7.com/azure/review-checklists/llms.txt

This KQL query is used within the checklist to verify the network policy configuration on Azure Kubernetes Service (AKS) clusters. It returns the resource ID and a compliance status indicating whether the network policy is enabled.

```kql
resources 
| where type=='microsoft.containerservice/managedclusters' 
| extend compliant = isnotnull(properties.networkProfile.networkPolicy) 
| distinct id, compliant
```

--------------------------------

### List Categories within an AKS Checklist

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

Lists the available categories within a specified checklist (e.g., AKS). This helps in scoping reviews to specific areas.

```Shell
./checklist_graph.sh --techonology=aks --list-categories
```

--------------------------------

### Scope Graph Queries to Management Group with checklist_graph.sh

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

This command scopes the `checklist_graph.sh` script to a specific management group. It requires the management group's name (not display name) and can be used with various technology and category flags. The output format depends on other flags used.

```bash
./checklist_graph.sh --technology=aks --category=1 --management-group=mymgmtgroup
```

--------------------------------

### Debug checklist_graph.sh Script Execution

Source: https://github.com/azure/review-checklists/blob/main/scripts/README.md

This command enables debug mode for the `checklist_graph.sh` script, outputting detailed messages to the Azure Cloud Shell console. This is useful for troubleshooting script execution issues. The `--format=json` flag can be used in conjunction with `--debug`.

```bash
./checklist_graph.sh --technology=aks --format=json --debug
```

--------------------------------

### Azure Resource Graph Query for Compliance

Source: https://github.com/azure/review-checklists/blob/main/CONTRIBUTING.md

This Kusto query is used to determine resource compliance for Azure Resource Graph recommendations. It filters for specific resource types and extends a 'compliant' column based on a condition, returning both 'id' and 'compliant' fields. Ensure single quotes are used within the query string to maintain JSON syntax.

```kusto
where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.