Release v1.47.0 (#3646)

Author: BernieWhite

README.md

@@ -10,7 +10,7 @@ Features of PSRule for Azure include:
 
 - [Learn by example][6] - Fix issues quickly, and learn how to improve your Infrastructure as Code..
 - [Framework aligned][7] - Apply principals of Azure Well-Architected Framework to your workloads.
-- [Start day one][2] - Leverage over 490 pre-built rules to test Azure resources.
+- [Start day one][2] - Leverage over 500 pre-built rules to test Azure resources.
 - [DevOps integrated][3] - Test Azure infrastructure as code such as Bicep or Azure Resource Manager templates.
 - [Cross-platform][4] - Run locally or in the cloud on MacOS, Linux, and Windows.
 - [Open community][8] - Open source rules for the Azure community.

docs/about.md

@@ -20,7 +20,7 @@ PSRule for Azure uses the principles of the Azure Well-Architected Framework (WA
   Examples are provided in Azure Bicep and ARM templates syntax.
 
 If you want to write your own tests, you can do that too in your choice of YAML, JSON, or PowerShell.
-However with over 490 tests already built, you can identify and fix issues day one.
+However with over 500 tests already built, you can identify and fix issues day one.
 
 !!! Learn "Get started with a sample repository"
     To get started with a sample repository, see [PSRule for Azure Quick Start][1] on GitHub.

docs/changelog.md

@@ -30,6 +30,132 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
 
 ## Unreleased
 
+## v1.47.0
+
+What's changed since v1.46.0:
+
+- New features:
+  - Added December 2025 baselines `Azure.GA_2025_12`, `Azure.Preview_2025_12`, and `Azure.CAF_2025_12` by @BernieWhite.
+    [#3642](https://github.com/Azure/PSRule.Rules.Azure/issues/3642)
+    - Includes rules released before or during December 2025.
+    - Marked `Azure.GA_2025_09` and `Azure.Preview_2025_09` baselines as obsolete.
+- New rules:
+  - Added naming format rules for AKS, Container Apps, Service Fabric, Cosmos DB, Redis, and SQL resources.
+    [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+  - App Configuration:
+    - Check that replica locations are in allowed regions by @BernieWhite.
+      [#3441](https://github.com/Azure/PSRule.Rules.Azure/issues/3441)
+  - Azure Cache for Redis:
+    - Check for legacy Azure Cache for Redis instances by @BenjaminEngeset.
+      [#3605](https://github.com/Azure/PSRule.Rules.Azure/issues/3605)
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_REDIS_CACHE_NAME_FORMAT`
+        - `AZURE_REDIS_ENTERPRISE_NAME_FORMAT`
+    - Added configured name format by @BernieWhite.
+  - Azure Cache for Redis Enterprise and Enterprise Flash:
+    - Check for deprecated Redis Enterprise and Enterprise Flash SKUs by @BenjaminEngeset.
+      [#3606](https://github.com/Azure/PSRule.Rules.Azure/issues/3606)
+  - Azure Database for MySQL:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_MYSQL_SERVER_NAME_FORMAT`
+  - Azure Database for PostgreSQL:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_POSTGRESQL_SERVER_NAME_FORMAT`
+  - Azure Kubernetes Service:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_AKS_CLUSTER_NAME_FORMAT`
+        - `AZURE_AKS_SYSTEM_POOL_NAME_FORMAT`
+        - `AZURE_AKS_USER_POOL_NAME_FORMAT`
+  - Container Apps:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_CONTAINER_APP_NAME_FORMAT`
+        - `AZURE_CONTAINER_APP_ENVIRONMENT_NAME_FORMAT`
+        - `AZURE_CONTAINER_APP_JOB_NAME_FORMAT`
+  - Container Instance:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration option:
+        - `AZURE_CONTAINER_INSTANCE_NAME_FORMAT`
+  - Container Registry:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration option:
+        - `AZURE_CONTAINER_REGISTRY_NAME_FORMAT`
+  - Cosmos DB:
+    - Check that Cosmos DB accounts have availability zones enabled by @BenjaminEngeset.
+      [#3055](https://github.com/Azure/PSRule.Rules.Azure/issues/3055)
+    - Check that MongoDB vCore clusters use Microsoft Entra ID authentication by @BenjaminEngeset.
+      [#3369](https://github.com/Azure/PSRule.Rules.Azure/issues/3369)
+    - Check that MongoDB vCore clusters have availability zones enabled by @BenjaminEngeset.
+      [#3586](https://github.com/Azure/PSRule.Rules.Azure/issues/3586)
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration options:
+        - `AZURE_COSMOS_CASSANDRA_NAME_FORMAT`
+        - `AZURE_COSMOS_DATABASE_NAME_FORMAT`
+        - `AZURE_COSMOS_GREMLIN_NAME_FORMAT`
+        - `AZURE_COSMOS_MONGO_NAME_FORMAT`
+        - `AZURE_COSMOS_NOSQL_NAME_FORMAT`
+        - `AZURE_COSMOS_POSTGRESQL_NAME_FORMAT`
+        - `AZURE_COSMOS_TABLE_NAME_FORMAT`
+  - Data Explorer:
+    - Check that public network access is disabled by @BenjaminEngeset.
+      [#3114](https://github.com/Azure/PSRule.Rules.Azure/issues/3114)
+  - Event Hub:
+    - Check that zone redundancy is enabled for Event Hub namespaces in supported regions by @BenjaminEngeset.
+      [#3029](https://github.com/Azure/PSRule.Rules.Azure/issues/3029)
+  - Managed Instance for Apache Cassandra:
+    - Check that Managed Instance for Apache Cassandra clusters have availability zones enabled by @BenjaminEngeset.
+      [#3592](https://github.com/Azure/PSRule.Rules.Azure/issues/3592)
+  - Managed Grafana:
+    - Check that zone redundancy is enabled for Grafana workspaces in supported regions by @BenjaminEngeset.
+      [#3294](https://github.com/Azure/PSRule.Rules.Azure/issues/3294)
+  - Service Fabric:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration option:
+        - `AZURE_SERVICE_FABRIC_CLUSTER_NAME_FORMAT`
+        - `AZURE_SERVICE_FABRIC_MANAGED_CLUSTER_NAME_FORMAT`
+  - SQL Database:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration option:
+        - `AZURE_SQL_DATABASE_NAME_FORMAT`
+        - `AZURE_SQL_SERVER_NAME_FORMAT`
+        - `AZURE_SQL_ELASTIC_POOL_NAME_FORMAT`
+        - `AZURE_SQL_JOB_AGENT_NAME_FORMAT`
+  - SQL Managed Instance:
+    - Check resources naming matches configured name format by @BernieWhite.
+      [#3548](https://github.com/Azure/PSRule.Rules.Azure/issues/3548)
+      - The name format can be configured by the following configuration option:
+        - `AZURE_SQL_MI_NAME_FORMAT`
+- Updated rules:
+  - Application Gateway Policy:
+    - Updated `Azure.AppGwWAF.RuleGroups` to use Microsoft Default Rule Set instead of legacy OWASP rule set by @BenjaminEngeset.
+      [#3553](https://github.com/Azure/PSRule.Rules.Azure/issues/3553)
+  - Cosmos DB:
+    - Renamed `Azure.Cosmos.DisableLocalAuth` to `Azure.Cosmos.NoSQLLocalAuth` to reflect it applies only to NoSQL API by @BernieWhite.
+      [#3576](https://github.com/Azure/PSRule.Rules.Azure/issues/3576)
+- Engineering:
+  - Bump Microsoft.Extensions.Logging.Console from 8.0.0 to 10.0.1
+    [#3627](https://github.com/Azure/PSRule.Rules.Azure/issues/3627)
+  - Bump Microsoft.Extensions.Hosting from 9.0.10 to 10.0.1
+    [#3626](https://github.com/Azure/PSRule.Rules.Azure/issues/3626)
+
+What's changed since pre-release v1.47.0-B0060:
+
+- No additional changes.
+
 ## v1.47.0-B0060 (pre-release)
 
 What's changed since v1.46.0:

docs/features.md

@@ -41,7 +41,7 @@ This allows you to explore and learn the context of each WAF principle.
 
 ## Start day one
 
-PSRule for Azure includes over 490 rules for validating resources against configuration recommendations.
+PSRule for Azure includes over 500 rules for validating resources against configuration recommendations.
 Rules automatically detect and analyze resources from Azure IaC artifacts.
 This allows you to quickly light up unit testing of Azure resources from templates and Bicep deployments.
 

docs/updates/v1.47.md

@@ -2,7 +2,7 @@
 date: 2025-12-30
 version: 1.47
 discussion: false
-draft: true
+draft: false
 ---
 
 # December 2025
@@ -19,6 +19,8 @@ See the [change log][1] or [GitHub history][2] for a complete list of changes.
 ## Expanded support for CAF naming
 
 Support for CAF naming conventions has been expanded with new rules to cover additional resource types.
+The new rules help enforce consistent, CAF-aligned resource names across environments.
+
 New resource types supported for enforcing naming conventions include:
 
 - `Microsoft.ContainerInstance/containerGroups`
@@ -45,6 +47,16 @@ New resource types supported for enforcing naming conventions include:
 - `Microsoft.Sql/servers/jobAgents`
 - `Microsoft.Sql/managedInstances`
 
+## New baselines
+
+This release adds three built-in baselines published for December 2025:
+
+- `Azure.GA_2025_12` — General Availability aligned baseline containing rules that match broadly available Azure service behavior and hardening recommendations.
+- `Azure.Preview_2025_12` — Preview aligned baseline that includes additional rules for preview features and newer service capabilities.
+- `Azure.CAF_2025_12` — Cloud Adoption Framework focused baseline designed to help enforce naming, tagging and recommended conventions for enterprise adoption.
+
+See examples of using baselines in the [Working with baselines](../working-with-baselines.md#using-baselines) documentation.
+
 ## Contributions
 
 We would like to thank the following contributors for their contributions to this release:

docs/working-with-baselines.md

@@ -118,7 +118,7 @@ See [reference][1] for a list baselines shipped with PSRule for Azure.
       uses: microsoft/ps-rule@v2.9.0
       with:
         modules: 'PSRule.Rules.Azure'
-        baseline: 'Azure.GA_2025_03'
+        baseline: 'Azure.GA_2025_12'
     ```
 
 === "Azure Pipelines"
@@ -131,19 +131,19 @@ See [reference][1] for a list baselines shipped with PSRule for Azure.
       displayName: Analyze Azure template files
       inputs:
         modules: 'PSRule.Rules.Azure'
-        baseline: 'Azure.GA_2025_03'
+        baseline: 'Azure.GA_2025_12'
     ```
 
 === "PowerShell"
 
     Update your PowerShell command-line with `-Baseline <name_of_baseline>`.
 
     ```powershell title="With Assert-PSRule"
-    Assert-PSRule -Format File -InputPath '.' -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2025_03'
+    Assert-PSRule -Format File -InputPath '.' -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2025_12'
     ```
 
     ```powershell title="With Invoke-PSRule"
-    Invoke-PSRule -Format File -InputPath '.' -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2025_03'
+    Invoke-PSRule -Format File -InputPath '.' -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2025_12'
     ```
 
   [1]: en/baselines/Azure.All.md

overrides/home.html

@@ -335,7 +335,7 @@ <h3 class="h4 text-brand font-weight-600 mb-3">Framework aligned</h3>
         <div>
           {% include ".icons/octicons/rocket-24.svg" %}
           <h3 class="h4 text-brand font-weight-600 mb-3">Start day one</h3>
-          <p>Leverage over 490 pre-built rules to test Azure resources.</p>
+          <p>Leverage over 500 pre-built rules to test Azure resources.</p>
         </div>
       </a>
       <a class="tile" href="features/#devops-integrated" target="_self" rel="noopener">