Azure Review Checklists

Azure Review Checklists provides best-practice design review templates for various Azure workloads. You can consume these checklists in two primary ways:

1. Excel Spreadsheets: Use the provided Excel files for manual design reviews and tracking findings. Detailed instructions can be found in the Excel documentation.
2. Azure Resource Graph Queries: Use automated queries to check existing deployments against the checklists. Detailed instructions can be found in the Azure Resource Graph Queries documentation.

This project uses GitHub Issues to track bugs and feature requests. Before filing a new issue, search the existing issues to avoid duplicates.

When reporting an issue or requesting a change related to a specific checklist, you must mention the relevant .en.json filename in the issue description to help maintainers identify the correct checklist.

If you want to contribute new or modified checklist items to the repository, follow these steps:

1. Load the latest version of the checklist in the .xlsm spreadsheet.
2. Make your desired modifications to the checklist items.
3. In the "Advanced" section of the spreadsheet controls, click the "Export checklist to JSON" button.
4. Save the resulting file to your local system.
5. Upload the file to the checklists/ folder in the GitHub repository using the naming convention <technology>_checklist.en.json (e.g., lz_checklist.en.json).
6. Submit a Pull Request for review.

The checklist_graph.sh script performs automated Azure Resource Graph queries associated with checklist items. It must be run in a Bash environment (e.g., Azure Cloud Shell). Ensure the identity executing the script has at least read access to the Azure resources you intend to query via Azure RBAC.

To download and prepare the script for execution, run:

wget -quiet -output-document=./checklist_graph.sh https://raw.githubusercontent.com/Azure/review-checklists/main/scripts/checklist_graph.sh
chmod +xr ./checklist_graph.sh

By default, queries are scoped to subscriptions. To scope the analysis to a specific Management Group, use the --management-group flag. You must provide the name of the management group, not its display name.

./checklist_graph.sh --technology=aks --category=1 --management-group=mymgmtgroup

You can quickly deploy pre-configured Azure Monitor workbooks using ARM templates. These workbooks use Azure Resource Graph queries to dynamically verify if your subscriptions comply with the checklist recommendations.

Available deployment templates include:

• Landing Zone review workbook
• Networking - Landing Zone review workbook
• AKS review workbook
• Network App Delivery workbook

https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Freview-checklists%2Fmain%2Fworkbooks%2Falz_checklist.en_workbook_template.json

You can run the script to generate a JSON-formatted output of all checklist items that have documented Azure Resource Graph queries for a specific technology (e.g., aks). This JSON file can be imported into an Excel spreadsheet using the Advanced command "Import Graph Results" to automatically populate the "Comments" column with compliance results and resource IDs.

./checklist_graph.sh --technology=aks --format=json > ./graph_results.json

This repository contains localized versions of checklists used for reviewing various Azure technologies.

Important Contribution Rule: If you find an error or an omission, do not submit a pull request to the localized version. Instead, always submit your pull request against the English version of the checklist files. The other language localizations are automatically generated from the English source using Azure Translator.

If you want to deploy a specific generated workbook without using an ARM template, you can manually copy the JSON content into an Azure Monitor workbook instance:

1. Locate the corresponding JSON file in the repository (e.g., alz_checklist.en_workbook.json or aks_checklist.en_workbook.json).
2. Open an Azure Monitor workbook in your Azure portal.
3. Switch to the Advanced Editor mode.
4. Paste the JSON content into the editor.

Once deployed, the workbook will execute Azure Resource Graph queries to list resources in your subscription that comply or do not comply with specific recommendations.

If the script fails or produces unexpected results, run it with the --debug flag and the --format=json flag to inspect the debug messages written to the console.

./checklist_graph.sh --technology=aks --format=json --debug

Because the spreadsheet uses macros to fetch data from GitHub, you may encounter security blocks.

Common Errors:

• Excel cannot open the file 'review_checklist.xlsm' because the file format or file extension is not valid...
• Macro warning messages that prevent loading checklist items.

Solutions:

1. Unblock the file: In Windows File Explorer, right-click the file, select Properties, and check the Unblock option to allow macros to run.
2. Add Windows Security Exception: If the file is still blocked, add the spreadsheet file to the exceptions list in Windows Security under the Virus & Threat Protection section.