allowedValues alignment

docs/wiki/Whats-new.md

@@ -1,6 +1,7 @@
 ## In this Section
 
 - [Updates](#updates)
+  - [July 2024](#july-2024)
   - [June 2024](#june-2024)
   - [🆕 AMA Updates](#-ama-updates)
   - [🔃 Policy Refresh H2 FY24](#-policy-refresh-h2-fy24)
@@ -46,11 +47,21 @@ This article will be updated as and when changes are made to the above and anyth
 
 Here's what's changed in Enterprise Scale/Azure Landing Zones:
 
+### July 2024
+
+#### Policy
+
+- Alignment of ****allowedValues*** in the following initiatives with those used in the included policyDefinitions:
+  - [Enforce recommended guardrails for Azure Key Vault](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-Guardrails-KeyVault.html)
+  - [Enforce recommended guardrails for Kubernetes](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-Guardrails-Kubernetes.html)
+  - [Enforce recommended guardrails for Network and Networking services](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-Guardrails-Network.html)
+  - [Enforce recommended guardrails for Synapse workspaces](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-Guardrails-Synapse.html)
+
 ### June 2024
 
 #### Documentation
 
-- As the Log Analytics agent is set to be retired on August 31, 2024, it is crucial for users to plan their migration to avoid any disruption in their monitoring services. The migration involves understanding the current setup, including agents, workspaces, solutions, insights, and data collections, and then configuring the new data collections to ensure a smooth transition. Tools like the AMA Migration Helper and DCR Config Generator can assist in automating and tracking the migration process. We've now made available [migration guidance](./ALZ-AMA-Migration-Guidance) to assist in the process.
+- As the Log Analytics agent is set to be retired on August 31, 2024, it is crucial for users to plan their migration to avoid any disruption in their monitoring services. The migration involves understanding the current setup, including agents, workspaces, solutions, insights, and data collections, and then configuring the new data collections to ensure a smooth transition. Tools like the AMA Migration Helper and DCR Config Generator can assist in automating and tracking the migration process. We've now made available **[migration guidance](./ALZ-AMA-Migration-Guidance) to assist in the process.
 - Developed a script to facilitate the transition from Microsoft Monitoring Agent (MMA) to Azure Monitor Agent (AMA) within Azure landing zones. Review the [migration guidance](./ALZ-AMA-Migration-Guidance) for additional information on how the script can be used.
 - General update AMA documentation [ALZ AMA Update](./ALZ-AMA-Update)
 

src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-KeyVault.json

@@ -8,7 +8,7 @@
         "displayName": "Enforce recommended guardrails for Azure Key Vault",
         "description": "Enforce recommended guardrails for Azure Key Vault.",
         "metadata": {
-            "version": "2.0.0",
+            "version": "2.1.0",
             "category": "Key Vault",
             "source": "https://github.com/Azure/Enterprise-Scale/",
             "alzCloudEnvironments": [
@@ -236,8 +236,11 @@
                 "type": "string",
                 "defaultValue": "Disabled",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },

src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Kubernetes.json

@@ -8,7 +8,7 @@
         "displayName": "Enforce recommended guardrails for Kubernetes",
         "description": "This policy initiative is a group of policies that ensures Kubernetes is compliant per regulated Landing Zones.",
         "metadata": {
-            "version": "1.0.0",
+            "version": "1.1.0",
             "category": "Kubernetes",
             "source": "https://github.com/Azure/Enterprise-Scale/",
             "alzCloudEnvironments": [
@@ -81,26 +81,35 @@
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },
             "aksPrivEscalation": {
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },
             "aksAllowedCapabilities": {
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },
@@ -117,17 +126,23 @@
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },
             "aksDefaultNamespace": {
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },
@@ -144,8 +159,11 @@
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
+                    "audit",
                     "Audit",
+                    "deny",
                     "Deny",
+                    "disabled",
                     "Disabled"
                 ]
             },

src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Network.json

@@ -8,7 +8,7 @@
         "displayName": "Enforce recommended guardrails for Network and Networking services",
         "description": "This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.",
         "metadata": {
-            "version": "1.0.0",
+            "version": "1.1.0",
             "category": "Network",
             "source": "https://github.com/Azure/Enterprise-Scale/",
             "alzCloudEnvironments": [
@@ -56,7 +56,12 @@
             },
             "vnetModifyDdos": {
                 "type": "string",
-                "defaultValue": "Modify"
+                "defaultValue": "Modify",
+                "allowedValues": [
+                    "Audit",
+                    "Modify",
+                    "Disabled"
+                ]
             },
             "ddosPlanResourceId": {
                 "type": "string",
@@ -229,9 +234,8 @@
                 "type": "string",
                 "defaultValue": "Deny",
                 "allowedValues": [
-                    "Audit",
-                    "Deny",
-                    "Disabled"
+                    "Allow",
+                    "Deny"
                 ]
             },
             "modifyNsgRuleProtocol": {

src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Synapse.json

@@ -8,7 +8,7 @@
         "displayName": "Enforce recommended guardrails for Synapse workspaces",
         "description": "This policy initiative is a group of policies that ensures Synapse workspaces is compliant per regulated Landing Zones.",
         "metadata": {
-            "version": "1.0.0",
+            "version": "1.1.0",
             "category": "Synapse",
             "source": "https://github.com/Azure/Enterprise-Scale/",
             "alzCloudEnvironments": [
@@ -65,7 +65,6 @@
                 "defaultValue": "Audit",
                 "allowedValues": [
                     "Audit",
-                    "Deny",
                     "Disabled"
                 ]
             },