Azure Arc: Hybride En Multi-cloud Beheer En Governance

<# .SYNOPSIS Inventariseert alle Azure Arc-verbonden resources en controleert governance- en compliance-aspecten. .DESCRIPTION Dit script inventariseert alle Arc-verbonden resources (servers, Kubernetes-clusters, data services) en beoordeelt in hoeverre governance-afspraken en beveiligingsmaatregelen zijn geïmplementeerd. Het controleert onder meer: - Aanwezigheid van Arc-enabled servers, Kubernetes-clusters en data services - Gebruik van consistente tagging voor eigenaarschap, classificatie en bedrijfsproces - Azure Policy-toewijzingen en compliance-status - Monitoring- en loggingconfiguraties In monitoringmodus wordt een rapport gegenereerd met de governance- en compliance-status per resource. In remediatiemodus wordt een overzicht gemaakt van resources met governance-hiaten, inclusief aanbevelingen voor vervolgstappen. .NOTES Filename: index.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-11-26 Last Modified: 2025-11-26 Version: 1.0 Related JSON: content/azure/arc/index.json .LINK https://github.com/[org]/m365-tenant-best-practise .EXAMPLE .\index.ps1 -Monitoring Voert een controle uit op alle Arc-verbonden resources en toont de governance-status. .EXAMPLE .\index.ps1 -Remediation Genereert een overzicht van resources met governance-hiaten en aanbevelingen voor verbetering. .EXAMPLE .\index.ps1 -Monitoring -LocalDebug Draait een lokale debug-run met gesimuleerde data zonder Azure-verbinding of Azure-API-calls. #> #Requires -Version 5.1 [CmdletBinding()] param( [Parameter()] [switch]$WhatIf, [Parameter()] [switch]$Monitoring, [Parameter()] [switch]$Remediation, [Parameter()] [string[]]$SubscriptionId, [Parameter()] [switch]$LocalDebug ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' $PolicyName = "Azure Arc: hybride en multi-cloud beheer en governance" $PolicyDescription = "Controleert of Arc-verbonden resources (servers, Kubernetes-clusters, data services) zijn opgenomen in centrale governance, inclusief tagging, Azure Policy en monitoring-configuraties." function Test-ModuleAvailability { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string[]]$ModuleName ) foreach ($name in $ModuleName) { if (-not (Get-Module -ListAvailable -Name $name)) { Write-Warning "Vereiste module '$name' is niet geïnstalleerd. Installeer deze module voor volledige functionaliteit." } } } function Connect-RequiredServices { <# .SYNOPSIS Maakt verbinding met Azure als dat nog niet is gebeurd. #> [CmdletBinding()] param() if ($LocalDebug) { Write-Verbose "LocalDebug is ingeschakeld; er wordt geen Azure-verbinding opgezet." return } Test-ModuleAvailability -ModuleName @('Az.Accounts', 'Az.Resources', 'Az.ResourceGraph', 'Az.ConnectedMachine') try { $context = Get-AzContext -ErrorAction SilentlyContinue if (-not $context) { Write-Host "Verbinding maken met Azure..." -ForegroundColor Yellow Connect-AzAccount -ErrorAction Stop | Out-Null } else { Write-Verbose "Reeds verbonden met Azure: $($context.Subscription.Name)" } } catch { Write-Error "Kon geen verbinding maken met Azure: $_" throw } } function Get-DebugArcData { [CmdletBinding()] param() return @{ Servers = @( [PSCustomObject]@{ SubscriptionId = "00000000-0000-0000-0000-000000000010" SubscriptionName = "DBG-Overheid-NonProd" ResourceGroupName = "rg-arc-servers-nonprod" MachineName = "arc-srv-nonprod-01" Location = "westeurope" OsType = "Windows" HasRequiredTags = $true ClassificationTag = "Confidential" OwnerTag = "Team Infrastructuur" BusinessProcessTag = "Burgerportaal" HasDefenderEnabled = $true HasMonitoringAgent = $true HasGovernanceIssues = $false GovernanceIssues = @() }, [PSCustomObject]@{ SubscriptionId = "00000000-0000-0000-0000-000000000020" SubscriptionName = "DBG-Overheid-Prod" ResourceGroupName = "rg-arc-servers-prod" MachineName = "arc-srv-prod-01" Location = "northeurope" OsType = "Linux" HasRequiredTags = $false ClassificationTag = "" OwnerTag = "" BusinessProcessTag = "" HasDefenderEnabled = $false HasMonitoringAgent = $false HasGovernanceIssues = $true GovernanceIssues = @( "Ontbrekende kern-tags (Owner, BusinessProcess, DataClassification)", "Microsoft Defender voor Servers niet geactiveerd", "Geen monitoring-agent geïnstalleerd" ) } ) Kubernetes = @( [PSCustomObject]@{ SubscriptionId = "00000000-0000-0000-0000-000000000010" SubscriptionName = "DBG-Overheid-NonProd" ResourceGroupName = "rg-arc-k8s-nonprod" ClusterName = "arc-k8s-nonprod-01" Location = "westeurope" Distribution = "AKS on Azure Stack HCI" HasRequiredTags = $true ClassificationTag = "Confidential" OwnerTag = "Team Digitale Diensten" BusinessProcessTag = "Burgerportaal" HasKubernetesPolicies = $true NonCompliantPolicyCount = 0 HasGitOpsConfig = $true HasGovernanceIssues = $false GovernanceIssues = @() } ) DataServices = @() } } function Get-ArcServersStatus { <# .SYNOPSIS Haalt Arc-enabled servers op en bepaalt de governance-status. .OUTPUTS PSCustomObject met server- en governance-informatie. #> [CmdletBinding()] param() if ($LocalDebug) { Write-Verbose "Gebruik van gesimuleerde Arc-serverdata (LocalDebug)." return (Get-DebugArcData).Servers } Write-Verbose "Ophalen van Arc-enabled servers via Azure Resource Graph..." $query = @' resources | where type =~ "microsoft.hybridcompute/machines" | project id, name, location, subscriptionId, resourceGroup, tags, properties '@ $argParams = @{ Query = $query } if ($SubscriptionId) { $argParams['Subscription'] = $SubscriptionId } $machines = Search-AzGraph @argParams $results = @() foreach ($machine in $machines) { $props = $machine.properties $tags = $machine.tags $classification = $tags["DataClassification"] $owner = $tags["Owner"] $businessProc = $tags["BusinessProcess"] $hasRequiredTags = -not [string]::IsNullOrWhiteSpace($classification) -and ` -not [string]::IsNullOrWhiteSpace($owner) -and ` -not [string]::IsNullOrWhiteSpace($businessProc) $osType = if ($props.osType) { $props.osType } else { "Unknown" } $governanceIssues = @() $hasIssues = $false if (-not $hasRequiredTags) { $hasIssues = $true $governanceIssues += "Ontbrekende kern-tags (Owner, BusinessProcess of DataClassification)." } # Check voor Defender (vereenvoudigd - in productie via Defender API) $hasDefender = $false try { # Vereenvoudigde check: controleer of Defender extensies aanwezig zijn $extensions = $props.extensions if ($extensions) { $hasDefender = ($extensions | Where-Object { $_.type -like "*Defender*" }).Count -gt 0 } } catch { Write-Verbose "Kon Defender-status niet bepalen voor server $($machine.name): $_" } if (-not $hasDefender) { $hasIssues = $true $governanceIssues += "Microsoft Defender voor Servers niet geactiveerd of extensie niet geïnstalleerd." } # Check voor monitoring agent $hasMonitoring = $false try { $extensions = $props.extensions if ($extensions) { $hasMonitoring = ($extensions | Where-Object { $_.type -like "*LogAnalytics*" -or $_.type -like "*AzureMonitor*" }).Count -gt 0 } } catch { Write-Verbose "Kon monitoring-status niet bepalen voor server $($machine.name): $_" } if (-not $hasMonitoring) { $hasIssues = $true $governanceIssues += "Geen monitoring-agent (Log Analytics of Azure Monitor) geïnstalleerd." } $results += [PSCustomObject]@{ SubscriptionId = $machine.subscriptionId SubscriptionName = (Get-AzSubscription -SubscriptionId $machine.subscriptionId -ErrorAction SilentlyContinue).Name ResourceGroupName = $machine.resourceGroup MachineName = $machine.name Location = $machine.location OsType = $osType HasRequiredTags = $hasRequiredTags ClassificationTag = $classification OwnerTag = $owner BusinessProcessTag = $businessProc HasDefenderEnabled = $hasDefender HasMonitoringAgent = $hasMonitoring HasGovernanceIssues = $hasIssues GovernanceIssues = $governanceIssues } } return $results } function Get-ArcKubernetesStatus { <# .SYNOPSIS Haalt Arc-enabled Kubernetes-clusters op en bepaalt de governance-status. #> [CmdletBinding()] param() if ($LocalDebug) { Write-Verbose "Gebruik van gesimuleerde Arc-Kubernetes-data (LocalDebug)." return (Get-DebugArcData).Kubernetes } Write-Verbose "Ophalen van Arc-enabled Kubernetes-clusters via Azure Resource Graph..." $query = @' resources | where type =~ "microsoft.kubernetes/connectedclusters" | project id, name, location, subscriptionId, resourceGroup, tags, properties '@ $argParams = @{ Query = $query } if ($SubscriptionId) { $argParams['Subscription'] = $SubscriptionId } $clusters = Search-AzGraph @argParams $results = @() foreach ($cluster in $clusters) { $tags = $cluster.tags $classification = $tags["DataClassification"] $owner = $tags["Owner"] $businessProc = $tags["BusinessProcess"] $hasRequiredTags = -not [string]::IsNullOrWhiteSpace($classification) -and ` -not [string]::IsNullOrWhiteSpace($owner) -and ` -not [string]::IsNullOrWhiteSpace($businessProc) $distribution = if ($cluster.properties.distribution) { $cluster.properties.distribution } else { "Unknown" } $governanceIssues = @() $hasIssues = $false if (-not $hasRequiredTags) { $hasIssues = $true $governanceIssues += "Ontbrekende kern-tags (Owner, BusinessProcess of DataClassification)." } # Vereenvoudigde policy-check $nonCompliantCount = 0 $hasK8sPolicies = $false try { $policyResults = Get-AzPolicyState -Filter "resourceId eq '$($cluster.id)'" -ErrorAction SilentlyContinue if ($policyResults) { $hasK8sPolicies = $true $nonCompliantCount = ($policyResults | Where-Object { $_.ComplianceState -eq 'NonCompliant' }).Count if ($nonCompliantCount -gt 0) { $hasIssues = $true $governanceIssues += "Azure Policy rapporteert $nonCompliantCount niet-conforme beleidsregels." } } } catch { Write-Verbose "Kon policy-status niet bepalen voor cluster $($cluster.name): $_" } # GitOps-check (vereenvoudigd) $hasGitOps = $false try { $kustomizations = Get-AzResource -ResourceType "Microsoft.KubernetesConfiguration/fluxConfigurations" -ErrorAction SilentlyContinue | Where-Object { $_.Properties.clusterResourceId -eq $cluster.id } if ($kustomizations) { $hasGitOps = $true } else { $hasIssues = $true $governanceIssues += "Geen GitOps-configuratie (Flux) gevonden voor dit Arc-enabled Kubernetes-cluster." } } catch { Write-Verbose "Kon GitOps-configuraties niet ophalen voor cluster $($cluster.name): $_" } $results += [PSCustomObject]@{ SubscriptionId = $cluster.subscriptionId SubscriptionName = (Get-AzSubscription -SubscriptionId $cluster.subscriptionId -ErrorAction SilentlyContinue).Name ResourceGroupName = $cluster.resourceGroup ClusterName = $cluster.name Location = $cluster.location Distribution = $distribution HasRequiredTags = $hasRequiredTags ClassificationTag = $classification OwnerTag = $owner BusinessProcessTag = $businessProc HasKubernetesPolicies = $hasK8sPolicies NonCompliantPolicyCount = $nonCompliantCount HasGitOpsConfig = $hasGitOps HasGovernanceIssues = $hasIssues GovernanceIssues = $governanceIssues } } return $results } function Get-ArcDataServicesStatus { <# .SYNOPSIS Haalt Arc-enabled data services op en bepaalt de governance-status. #> [CmdletBinding()] param() if ($LocalDebug) { Write-Verbose "Gebruik van gesimuleerde Arc-data services-data (LocalDebug)." return (Get-DebugArcData).DataServices } Write-Verbose "Ophalen van Arc-enabled data services via Azure Resource Graph..." $query = @' resources | where type =~ "microsoft.azurearcdata/sqlServerInstances" or type =~ "microsoft.azurearcdata/postgresInstances" | project id, name, location, subscriptionId, resourceGroup, tags, type '@ $argParams = @{ Query = $query } if ($SubscriptionId) { $argParams['Subscription'] = $SubscriptionId } $dataServices = Search-AzGraph @argParams $results = @() foreach ($ds in $dataServices) { $tags = $ds.tags $classification = $tags["DataClassification"] $owner = $tags["Owner"] $businessProc = $tags["BusinessProcess"] $hasRequiredTags = -not [string]::IsNullOrWhiteSpace($classification) -and ` -not [string]::IsNullOrWhiteSpace($owner) -and ` -not [string]::IsNullOrWhiteSpace($businessProc) $serviceType = if ($ds.type -like "*sqlServer*") { "SQL Server" } else { "PostgreSQL" } $governanceIssues = @() $hasIssues = $false if (-not $hasRequiredTags) { $hasIssues = $true $governanceIssues += "Ontbrekende kern-tags (Owner, BusinessProcess of DataClassification)." } $results += [PSCustomObject]@{ SubscriptionId = $ds.subscriptionId SubscriptionName = (Get-AzSubscription -SubscriptionId $ds.subscriptionId -ErrorAction SilentlyContinue).Name ResourceGroupName = $ds.resourceGroup ServiceName = $ds.name Location = $ds.location ServiceType = $serviceType HasRequiredTags = $hasRequiredTags ClassificationTag = $classification OwnerTag = $owner BusinessProcessTag = $businessProc HasGovernanceIssues = $hasIssues GovernanceIssues = $governanceIssues } } return $results } function Test-Compliance { <# .SYNOPSIS Bepaalt de compliancestatus voor Azure Arc governance. .OUTPUTS PSCustomObject met samenvatting van de resultaten. #> [CmdletBinding()] param() $servers = Get-ArcServersStatus $kubernetes = Get-ArcKubernetesStatus $dataServices = Get-ArcDataServicesStatus $allResources = @( foreach ($s in $servers) { [PSCustomObject]@{ ResourceType = "Server" ResourceName = $s.MachineName SubscriptionId = $s.SubscriptionId SubscriptionName = $s.SubscriptionName HasGovernanceIssues = $s.HasGovernanceIssues GovernanceIssues = $s.GovernanceIssues } } foreach ($k in $kubernetes) { [PSCustomObject]@{ ResourceType = "Kubernetes" ResourceName = $k.ClusterName SubscriptionId = $k.SubscriptionId SubscriptionName = $k.SubscriptionName HasGovernanceIssues = $k.HasGovernanceIssues GovernanceIssues = $k.GovernanceIssues } } foreach ($d in $dataServices) { [PSCustomObject]@{ ResourceType = "DataService" ResourceName = $d.ServiceName SubscriptionId = $d.SubscriptionId SubscriptionName = $d.SubscriptionName HasGovernanceIssues = $d.HasGovernanceIssues GovernanceIssues = $d.GovernanceIssues } } ) if ($allResources.Count -eq 0) { Write-Verbose "Geen Arc-verbonden resources gevonden in de geselecteerde scope." return [PSCustomObject]@{ ScriptName = "azure-arc-overview" IsCompliant = $true Timestamp = Get-Date Details = "Er zijn geen Arc-verbonden resources gevonden in de huidige scope." Recommendations = @() Servers = @() Kubernetes = @() DataServices = @() } } $nonCompliant = $allResources | Where-Object { $_.HasGovernanceIssues } $isCompliant = ($nonCompliant.Count -eq 0) $details = if ($isCompliant) { "Alle gevonden Arc-verbonden resources voldoen aan de basis governance-vereisten." } else { "Een of meer Arc-verbonden resources hebben governance-hiaten die aandacht vereisen." } $recommendations = @() if (-not $isCompliant) { $recommendations += "Zorg dat alle Arc-resources kern-tags bevatten: Owner, BusinessProcess en DataClassification." $recommendations += "Activeer Microsoft Defender-services voor Arc-enabled servers en Kubernetes-clusters." $recommendations += "Installeer monitoring-agents (Log Analytics of Azure Monitor) op Arc-enabled servers." $recommendations += "Implementeer Azure Policy voor Arc-resources om configuratiestandaarden af te dwingen." $recommendations += "Configureer GitOps (Flux) voor Arc-enabled Kubernetes-clusters." $recommendations += "Documenteer governance-afspraken en neem Arc-resources op in incidentresponsprocedures." } return [PSCustomObject]@{ ScriptName = "azure-arc-overview" IsCompliant = $isCompliant Timestamp = Get-Date Details = $details Recommendations = $recommendations Servers = $servers Kubernetes = $kubernetes DataServices = $dataServices } } function Invoke-Monitoring { <# .SYNOPSIS Voert een monitoring-run uit en toont de governance-status per Arc-resource. #> [CmdletBinding()] param() Write-Host "`nMonitoring: $PolicyName" -ForegroundColor Yellow Write-Host "Beschrijving: $PolicyDescription" -ForegroundColor Yellow Write-Host "==============================================================" -ForegroundColor Yellow $result = Test-Compliance if ($result.Servers.Count -gt 0) { Write-Host "`nArc-enabled Servers:" -ForegroundColor Cyan foreach ($server in $result.Servers) { $statusColor = if (-not $server.HasGovernanceIssues) { "Green" } else { "Red" } $statusText = if (-not $server.HasGovernanceIssues) { "COMPLIANT" } else { "NON-COMPLIANT - $($server.GovernanceIssues.Count) issue(s)" } Write-Host ("- {0}/{1} ({2}, {3})" -f $server.SubscriptionName, $server.MachineName, $server.OsType, $server.Location) -ForegroundColor $statusColor Write-Host (" Tags: {0}" -f $(if ($server.HasRequiredTags) { "Aanwezig" } else { "Ontbrekend" })) -ForegroundColor Gray Write-Host (" Defender: {0}" -f $(if ($server.HasDefenderEnabled) { "Geactiveerd" } else { "Niet geactiveerd" })) -ForegroundColor Gray Write-Host (" Monitoring: {0}" -f $(if ($server.HasMonitoringAgent) { "Aanwezig" } else { "Afwezig" })) -ForegroundColor Gray Write-Host (" Status: {0}" -f $statusText) -ForegroundColor $statusColor if ($server.GovernanceIssues.Count -gt 0) { foreach ($issue in $server.GovernanceIssues) { Write-Host (" - {0}" -f $issue) -ForegroundColor Yellow } } Write-Host "" } } if ($result.Kubernetes.Count -gt 0) { Write-Host "Arc-enabled Kubernetes-clusters:" -ForegroundColor Cyan foreach ($cluster in $result.Kubernetes) { $statusColor = if (-not $cluster.HasGovernanceIssues) { "Green" } else { "Red" } $statusText = if (-not $cluster.HasGovernanceIssues) { "COMPLIANT" } else { "NON-COMPLIANT - $($cluster.GovernanceIssues.Count) issue(s)" } Write-Host ("- {0}/{1} ({2})" -f $cluster.SubscriptionName, $cluster.ClusterName, $cluster.Location) -ForegroundColor $statusColor Write-Host (" Distributie: {0}" -f $cluster.Distribution) -ForegroundColor Gray Write-Host (" Tags: {0}" -f $(if ($cluster.HasRequiredTags) { "Aanwezig" } else { "Ontbrekend" })) -ForegroundColor Gray Write-Host (" Azure Policy: {0} niet-conforme regels" -f $cluster.NonCompliantPolicyCount) -ForegroundColor Gray Write-Host (" GitOps: {0}" -f $(if ($cluster.HasGitOpsConfig) { "Aanwezig" } else { "Afwezig" })) -ForegroundColor Gray Write-Host (" Status: {0}" -f $statusText) -ForegroundColor $statusColor if ($cluster.GovernanceIssues.Count -gt 0) { foreach ($issue in $cluster.GovernanceIssues) { Write-Host (" - {0}" -f $issue) -ForegroundColor Yellow } } Write-Host "" } } if ($result.DataServices.Count -gt 0) { Write-Host "Arc-enabled Data Services:" -ForegroundColor Cyan foreach ($ds in $result.DataServices) { $statusColor = if (-not $ds.HasGovernanceIssues) { "Green" } else { "Red" } $statusText = if (-not $ds.HasGovernanceIssues) { "COMPLIANT" } else { "NON-COMPLIANT - $($ds.GovernanceIssues.Count) issue(s)" } Write-Host ("- {0}/{1} ({2}, {3})" -f $ds.SubscriptionName, $ds.ServiceName, $ds.ServiceType, $ds.Location) -ForegroundColor $statusColor Write-Host (" Tags: {0}" -f $(if ($ds.HasRequiredTags) { "Aanwezig" } else { "Ontbrekend" })) -ForegroundColor Gray Write-Host (" Status: {0}" -f $statusText) -ForegroundColor $statusColor if ($ds.GovernanceIssues.Count -gt 0) { foreach ($issue in $ds.GovernanceIssues) { Write-Host (" - {0}" -f $issue) -ForegroundColor Yellow } } Write-Host "" } } $totalCount = $result.Servers.Count + $result.Kubernetes.Count + $result.DataServices.Count if ($totalCount -eq 0) { Write-Host "`nGeen Arc-verbonden resources gevonden in de huidige scope." -ForegroundColor Cyan } if ($result.IsCompliant) { Write-Host "✅ COMPLIANT - Alle Arc-verbonden resources voldoen aan de basis governance-vereisten." -ForegroundColor Green } else { Write-Host "❌ NON-COMPLIANT - Eén of meer Arc-verbonden resources hebben governance-hiaten." -ForegroundColor Red Write-Host "Aanbevolen acties:" -ForegroundColor Yellow foreach ($rec in $result.Recommendations) { Write-Host (" - {0}" -f $rec) -ForegroundColor Yellow } } return $result } function Invoke-Remediation { <# .SYNOPSIS Geeft een remediatie-overzicht voor Arc-resources met governance-hiaten. #> [CmdletBinding()] param() Write-Host "`nRemediatie: $PolicyName" -ForegroundColor Yellow Write-Host "==============================================================" -ForegroundColor Yellow $result = Test-Compliance $allNonCompliant = @() $allNonCompliant += $result.Servers | Where-Object { $_.HasGovernanceIssues } $allNonCompliant += $result.Kubernetes | Where-Object { $_.HasGovernanceIssues } $allNonCompliant += $result.DataServices | Where-Object { $_.HasGovernanceIssues } if ($allNonCompliant.Count -eq 0) { Write-Host "Alle Arc-verbonden resources voldoen aan de basis governance-vereisten. Geen remediatie nodig." -ForegroundColor Green return $result } Write-Host "`nNiet-conforme Arc-resources (met governance-hiaten):" -ForegroundColor Red foreach ($resource in $allNonCompliant) { $resourceType = switch -Regex ($resource.PSObject.Properties.Name) { "MachineName" { "Server" } "ClusterName" { "Kubernetes" } "ServiceName" { "Data Service" } default { "Unknown" } } Write-Host ("- Type: {0}" -f $resourceType) -ForegroundColor Red Write-Host (" Subscription: {0}" -f $resource.SubscriptionName) -ForegroundColor Red Write-Host (" ResourceGroup: {0}" -f $resource.ResourceGroupName) -ForegroundColor Red $resourceName = if ($resource.MachineName) { $resource.MachineName } elseif ($resource.ClusterName) { $resource.ClusterName } elseif ($resource.ServiceName) { $resource.ServiceName } else { "Unknown" } Write-Host (" Resource: {0}" -f $resourceName) -ForegroundColor Red Write-Host (" Locatie: {0}" -f $resource.Location) -ForegroundColor Red Write-Host " Geïdentificeerde issues:" -ForegroundColor Yellow foreach ($issue in $resource.GovernanceIssues) { Write-Host (" - {0}" -f $issue) -ForegroundColor Yellow } Write-Host "" } Write-Host "Aanbevolen vervolgstappen:" -ForegroundColor Yellow Write-Host "1. Vul ontbrekende kern-tags in (Owner, BusinessProcess, DataClassification) voor alle Arc-resources." -ForegroundColor Yellow Write-Host "2. Activeer Microsoft Defender-services voor Arc-enabled servers en Kubernetes-clusters." -ForegroundColor Yellow Write-Host "3. Installeer monitoring-agents (Log Analytics of Azure Monitor) op Arc-enabled servers." -ForegroundColor Yellow Write-Host "4. Implementeer Azure Policy voor Arc-resources om configuratiestandaarden af te dwingen." -ForegroundColor Yellow Write-Host "5. Configureer GitOps (Flux) voor Arc-enabled Kubernetes-clusters." -ForegroundColor Yellow Write-Host "6. Documenteer governance-afspraken en neem Arc-resources op in incidentresponsprocedures." -ForegroundColor Yellow Write-Host "7. Plan periodieke evaluaties van Arc-governance en veranker verbeteracties in de roadmap." -ForegroundColor Yellow if ($WhatIf) { Write-Host "`nWhatIf is ingeschakeld: er worden geen wijzigingen doorgevoerd; alleen een rapport is gegenereerd." -ForegroundColor Cyan } return $result } try { Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Script: azure-arc-overview" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan Connect-RequiredServices if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { $result = Test-Compliance if ($result.IsCompliant) { Write-Host "`n✅ COMPLIANT" -ForegroundColor Green } else { Write-Host "`n❌ NON-COMPLIANT" -ForegroundColor Red Write-Host "`nRun met -Monitoring voor een gedetailleerd rapport" -ForegroundColor Yellow Write-Host "Run met -Remediation voor aanbevelingen" -ForegroundColor Yellow } return $result } } catch { Write-Error "Error: $_" throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }