PSRule.Rules.Azure

1.21.1

rules/Azure.APIM.Rule.ps1

                                # Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# Validation rules for API Management

#

# Synopsis: Enforce HTTPS for communication to API clients.

Rule 'Azure.APIM.HTTPEndpoint' -Ref 'AZR-000042' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/apis' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.ASB.v3/control' = 'DP-3' } {

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $apis = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/apis')

        if ($apis.Length -eq 0) {

            return $Assert.Pass();

        }

        foreach ($api in $apis) {

            $Assert.NotIn($api, 'properties.protocols', @('http'))

        }

    }

    elseif ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service/apis') {

        $Assert.NotIn($TargetObject, 'properties.protocols', @('http'))

    }

}

# Synopsis: APIs should have descriptors set

Rule 'Azure.APIM.APIDescriptors' -Ref 'AZR-000043' -Level Warning -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/apis' -Tag @{ release = 'GA'; ruleSet = '2020_09' } {

    $apis = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $apis = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/apis');

    }

    if ($apis.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($api in $apis) {

        $Assert.

            HasFieldValue($api, 'Properties.displayName').

            Reason($LocalizedData.APIMDescriptors, 'API', $api.name, 'displayName');

        $Assert.

            HasFieldValue($api, 'Properties.description').

            Reason($LocalizedData.APIMDescriptors, 'API', $api.name, 'description');

    }

}

# Synopsis: Use HTTPS for communication to backend services.

Rule 'Azure.APIM.HTTPBackend' -Ref 'AZR-000044' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/backends', 'Microsoft.ApiManagement/service/apis' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.ASB.v3/control' = 'DP-3' } {

    $apis = @();

    $backends = @();

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $backends = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/backends' | Where-Object {

            $Assert.HasField($_, 'properties.url').Result

        });

        $apis = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/apis' | Where-Object {

            $Assert.HasField($_, 'properties.serviceUrl').Result

        });

    }

    elseif ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service/apis') {

        if ($Assert.HasField($TargetObject, 'properties.serviceUrl').Result) {

            $apis = @($TargetObject)

        }

    }

    elseif ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service/backends') {

        if ($Assert.HasField($TargetObject, 'properties.url').Result) {

            $backends = @($TargetObject)

        }

    }

    if ($backends.Length -eq 0 -and $apis.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($backend in $backends) {

        $Assert.

            NotStartsWith($backend, 'properties.url', 'http://').

            Reason($LocalizedData.BackendUrlNotHttps, $backend.name);

    }

    foreach ($api in $apis) {

        $Assert.

            NotStartsWith($api, 'properties.serviceUrl', 'http://').

            Reason($LocalizedData.ServiceUrlNotHttps, $api.name);

    }

}

# Synopsis: Encrypt all named values

Rule 'Azure.APIM.EncryptValues' -Ref 'AZR-000045' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/properties', 'Microsoft.ApiManagement/service/namedValues' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.ASB.v3/control' = @('IM-8', 'DP-7') } {

    $properties = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $properties = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/properties', 'Microsoft.ApiManagement/service/namedValues');

    }

    if ($properties.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($property in $properties) {

        $Assert.

            HasFieldValue($property, 'properties.secret', $True).

            WithReason(($LocalizedData.APIMSecretNamedValues -f $property.name), $True);

    }

}

# Synopsis: Require subscription for products

Rule 'Azure.APIM.ProductSubscription' -Ref 'AZR-000046' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/products' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $products = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $products = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/products');

    }

    if ($products.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($product in $products) {

        $Assert.

            HasFieldValue($product, 'Properties.subscriptionRequired', $True).

            WithReason(($LocalizedData.APIMProductSubscription -f $product.Name), $True);

    }

}

# Synopsis: Require approval for products

Rule 'Azure.APIM.ProductApproval' -Ref 'AZR-000047' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/products' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $products = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $products = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/products');

    }

    if ($products.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($product in $products) {

        $Assert.

            HasFieldValue($product, 'Properties.approvalRequired', $True).

            WithReason(($LocalizedData.APIMProductApproval -f $product.Name), $True);

    }

}

# Synopsis: Remove sample products

Rule 'Azure.APIM.SampleProducts' -Ref 'AZR-000048' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/products' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $products = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $products = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/products');

    }

    if ($products.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($product in $products) {

        $Assert.NotIn($product, 'Name', @('unlimited', 'starter'))

    }

}

# Synopsis: Products should have descriptors set

Rule 'Azure.APIM.ProductDescriptors' -Ref 'AZR-000049' -Level Warning -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/products' -Tag @{ release = 'GA'; ruleSet = '2020_09' } {

    $products = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $products = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/products');

    }

    if ($products.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($product in $products) {

        $Assert.

            HasFieldValue($product, 'Properties.displayName').

            WithReason(($LocalizedData.APIMDescriptors -f 'product', $product.name, 'displayName'), $True);

        $Assert.

            HasFieldValue($product, 'Properties.description').

            WithReason(($LocalizedData.APIMDescriptors -f 'product', $product.name, 'description'), $True);

    }

}

# Synopsis: Use product terms

Rule 'Azure.APIM.ProductTerms' -Ref 'AZR-000050' -Type 'Microsoft.ApiManagement/service', 'Microsoft.ApiManagement/service/products' -Tag @{ release = 'GA'; ruleSet = '2020_09' } {

    $products = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.ApiManagement/service') {

        $products = @(GetSubResources -ResourceType 'Microsoft.ApiManagement/service/products');

    }

    if ($products.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($product in $products) {

        $Assert.

            HasFieldValue($product, 'Properties.terms').

            WithReason(($LocalizedData.APIMProductTerms -f $product.name), $True);

    }

}

# Synopsis: Renew expired certificates

Rule 'Azure.APIM.CertificateExpiry' -Ref 'AZR-000051' -Type 'Microsoft.ApiManagement/service' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.ASB.v3/control' = 'DP-7' } {

    $configurations = @($TargetObject.Properties.hostnameConfigurations | Where-Object {

        $Null -ne $_.certificate

    })

    if ($configurations.Length -eq 0) {

        return $Assert.Pass();

    }

    foreach ($configuration in $configurations) {

        $remaining = ($configuration.certificate.expiry - [DateTime]::Now).Days;

        $Assert.

            GreaterOrEqual($remaining, '.', $Configuration.Azure_MinimumCertificateLifetime).

            WithReason(($LocalizedData.APIMCertificateExpiry -f $configuration.hostName, $configuration.certificate.expiry.ToString('yyyy/MM/dd')), $True);

    }

} -Configure @{ Azure_MinimumCertificateLifetime = 30 }

# Synopsis: API management services deployed with Premium SKU should use availability zones in supported regions for high availability.

Rule 'Azure.APIM.AvailabilityZone' -Ref 'AZR-000052' -Type 'Microsoft.ApiManagement/service' -If { IsPremiumAPIM } -Tag @{ release = 'GA'; ruleSet = '2021_12' } {

    $apiManagementServiceProvider = [PSRule.Rules.Azure.Runtime.Helper]::GetResourceType('Microsoft.ApiManagement', 'service');

    $configurationZoneMappings = $Configuration.AZURE_APIM_ADDITIONAL_REGION_AVAILABILITY_ZONE_LIST;

    $providerZoneMappings = $apiManagementServiceProvider.ZoneMappings;

    $mergedAvailabilityZones = PrependConfigurationZoneWithProviderZone -ConfigurationZone $configurationZoneMappings -ProviderZone $providerZoneMappings;

    $primaryLocationAvailabilityZones = GetAvailabilityZone -Location $TargetObject.Location -Zone $mergedAvailabilityZones;

    # Validate primary location availability zones

    if (-not $primaryLocationAvailabilityZones) {

        $Assert.Pass();

    }

    else {

        $hasValidUnits = $Assert.GreaterOrEqual($TargetObject, 'sku.capacity', $TargetObject.zones.Length).Result;

        $hasValidZones = $Assert.GreaterOrEqual($TargetObject, 'zones', 2).Result;

        $Assert.Create(

            ($hasValidUnits -and $hasValidZones),

            $LocalizedData.APIMAvailabilityZone, 

            $TargetObject.name, 

            $TargetObject.Location, 

            ($primaryLocationAvailabilityZones -join ', ')

        )

    }

    # Also validate any additional locations that are added to APIM

    if (-not $Assert.NullOrEmpty($TargetObject, 'Properties.additionalLocations').Result) {

        foreach ($additionalLocation in $TargetObject.Properties.additionalLocations) {

            $additionalLocationAvailabilityZones = GetAvailabilityZone -Location $additionalLocation.Location -Zone $mergedAvailabilityZones;

            if (-not $additionalLocationAvailabilityZones) {

                $Assert.Pass();

            }

            else {

                $hasValidUnits = $Assert.GreaterOrEqual($additionalLocation, 'sku.capacity', $additionalLocation.zones.Length).Result;

                $hasValidZones = $Assert.GreaterOrEqual($additionalLocation, 'zones', 2).Result;

                $Assert.Create(

                    ($hasValidUnits -and $hasValidZones),

                    $LocalizedData.APIMAvailabilityZone, 

                    $TargetObject.name, 

                    $additionalLocation.Location, 

                    ($additionalLocationAvailabilityZones -join ', ')

                );

            }

        }

    }

} -Configure @{ AZURE_APIM_ADDITIONAL_REGION_AVAILABILITY_ZONE_LIST = @() }

#region Helper functions

function global:IsPremiumAPIM {

    [CmdletBinding()]

    [OutputType([System.Boolean])]

    param ()

    process {

        return $Assert.HasFieldValue($TargetObject, 'sku.name', 'Premium').Result;

    }

}

#endregion Helper functions

# SIG # Begin signature block

# MIInogYJKoZIhvcNAQcCoIInkzCCJ48CAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAqp+E0Ez1SljGC

# 1/WoAEnltmvK8sM74TkDVQF4urUATaCCDYUwggYDMIID66ADAgECAhMzAAACzfNk

# v/jUTF1RAAAAAALNMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjIwNTEyMjA0NjAyWhcNMjMwNTExMjA0NjAyWjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQDrIzsY62MmKrzergm7Ucnu+DuSHdgzRZVCIGi9CalFrhwtiK+3FIDzlOYbs/zz

# HwuLC3hir55wVgHoaC4liQwQ60wVyR17EZPa4BQ28C5ARlxqftdp3H8RrXWbVyvQ

# aUnBQVZM73XDyGV1oUPZGHGWtgdqtBUd60VjnFPICSf8pnFiit6hvSxH5IVWI0iO

# nfqdXYoPWUtVUMmVqW1yBX0NtbQlSHIU6hlPvo9/uqKvkjFUFA2LbC9AWQbJmH+1

# uM0l4nDSKfCqccvdI5l3zjEk9yUSUmh1IQhDFn+5SL2JmnCF0jZEZ4f5HE7ykDP+

# oiA3Q+fhKCseg+0aEHi+DRPZAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQU0WymH4CP7s1+yQktEwbcLQuR9Zww

# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh

# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzQ3MDUzMDAfBgNVHSMEGDAW

# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw

# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov

# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx

# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB

# AE7LSuuNObCBWYuttxJAgilXJ92GpyV/fTiyXHZ/9LbzXs/MfKnPwRydlmA2ak0r

# GWLDFh89zAWHFI8t9JLwpd/VRoVE3+WyzTIskdbBnHbf1yjo/+0tpHlnroFJdcDS

# MIsH+T7z3ClY+6WnjSTetpg1Y/pLOLXZpZjYeXQiFwo9G5lzUcSd8YVQNPQAGICl

# 2JRSaCNlzAdIFCF5PNKoXbJtEqDcPZ8oDrM9KdO7TqUE5VqeBe6DggY1sZYnQD+/

# LWlz5D0wCriNgGQ/TWWexMwwnEqlIwfkIcNFxo0QND/6Ya9DTAUykk2SKGSPt0kL

# tHxNEn2GJvcNtfohVY/b0tuyF05eXE3cdtYZbeGoU1xQixPZAlTdtLmeFNly82uB

# VbybAZ4Ut18F//UrugVQ9UUdK1uYmc+2SdRQQCccKwXGOuYgZ1ULW2u5PyfWxzo4

# BR++53OB/tZXQpz4OkgBZeqs9YaYLFfKRlQHVtmQghFHzB5v/WFonxDVlvPxy2go

# a0u9Z+ZlIpvooZRvm6OtXxdAjMBcWBAsnBRr/Oj5s356EDdf2l/sLwLFYE61t+ME

# iNYdy0pXL6gN3DxTVf2qjJxXFkFfjjTisndudHsguEMk8mEtnvwo9fOSKT6oRHhM

# 9sZ4HTg/TTMjUljmN3mBYWAWI5ExdC1inuog0xrKmOWVMIIHejCCBWKgAwIBAgIK

# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm

# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw

# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD

# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG

# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la

# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc

# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D

# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+

# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk

# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6

# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd

# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL

# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd

# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3

# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS

# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI

# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL

# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD

# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv

# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF

# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h

# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA

# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn

# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7

# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b

# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/

# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy

# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp

# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi

# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb

# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS

# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL

# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX

# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGXMwghlvAgEBMIGVMH4x

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p

# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAALN82S/+NRMXVEAAAAA

# As0wDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw

# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEINCV

# Op3kDRiE84gNDBG0+Z3ugci0NMO3muYqeDGlHnJDMEIGCisGAQQBgjcCAQwxNDAy

# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20wDQYJKoZIhvcNAQEBBQAEggEAl3dx+bppMtUh+nigsNalLAI1zbQIX3iUEcJX

# EkZV3sLPQBLAaqBP51mAWmf0JY0/WO5OSfAENUC14sBlkr9A3viCfPAFAasbrjNk

# DAeyffuumkW0em8ss8u8/bnK2uECSI0WFub5H7zoSOZEff2erWsDja9EXaCKjBNd

# PNLAEJ7XDoxYDmSilTGa+hmz+LIJSihxN/WLcIWdPnB8G5ZWa3wYvhrxLi3Ch/EM

# uhXSiy1t57r0SrUn/ZLfiF3TBZiITUW80FWjx1XeDCHhT87l6QhpjU5VHCNqlBKD

# 63nSsC9Ho8A2FrZfniiw3P7wFHYVICuAG11c6m4JzN4ivPNQIaGCFv0wghb5Bgor

# BgEEAYI3AwMBMYIW6TCCFuUGCSqGSIb3DQEHAqCCFtYwghbSAgEDMQ8wDQYJYIZI

# AWUDBAIBBQAwggFRBgsqhkiG9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGE

# WQoDATAxMA0GCWCGSAFlAwQCAQUABCCML7u/hOEn/vlfBiZqyGhDqjEXMw2Wi9nT

# /4ACMmwcWQIGY0hAHo0RGBMyMDIyMTAzMTE2MTgxMy42MTFaMASAAgH0oIHQpIHN

# MIHKMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH

# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL

# ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMSYwJAYDVQQLEx1UaGFsZXMg

# VFNTIEVTTjpBRTJDLUUzMkItMUFGQzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUt

# U3RhbXAgU2VydmljZaCCEVQwggcMMIIE9KADAgECAhMzAAABlklbYuEv3fdPAAEA

# AAGWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNo

# aW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29y

# cG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEw

# MB4XDTIxMTIwMjE5MDUxM1oXDTIzMDIyODE5MDUxM1owgcoxCzAJBgNVBAYTAlVT

# MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK

# ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVy

# aWNhIE9wZXJhdGlvbnMxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNOOkFFMkMtRTMy

# Qi0xQUZDMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIIC

# IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0h9sEAtvrf48wOoy+i2TIQzS

# RtJ79XFKnvh+DBishIEWVMKdWLB5dSExsovCva5D0SiigItJU/ING9RiIqZFnPKg

# rRN8Im8aDUeJgsq74BLF7rZ28SNaG8fHDH2tl4HIRv1wRmXBbRndFEL15MVGL6JH

# xtU8gTKpyGb0Ni7XJho/OpWj0TbkaHZBDO1VVDtqDEhyW2kzY9W9pAAvLKpcrR9c

# 5n60KUwN62TshJssE+Nw0X7DZV5pDSjIluwWnzZx2SxhxmnKYphOHaAzLq98oh/6

# ggsdjzuKSKpAOlixkjfMoWGr3EGURVbbJf8fyIri9H8TxqUJkXPOJuNcmrp3L3jY

# f+f9eDKrGe7oGNYsfH5DmICQZS7LPJsj4WjAOqnBAf0VlqnAn4cgETYwnJgTRjV3

# jICsmf/nt2wjpV5lng7VSQy5jrcxAwS5pINv3rad0/YTl/i6HWMHQZGNp6AgxMz1

# lWvN+AJpCb0espxHgRo+qLlon6V8WqGwXWrG9Pq//XmK/k9NMqyxZ9eq601C51c5

# Fu5S8l1hKLrL82J7pdxzwkKKEEuC2NRwSk8k0n7Rl+emYDs+0ZPnrL23K/jYy7wQ

# cu13qJoJLsNRf1K7u5WfQEfhEG6YNqbwh0mqzEEB239Rlz4ZQ0x8JHrJEYs+Yz40

# 69Vs/3/vQmceaL7UxdECAwEAAaOCATYwggEyMB0GA1UdDgQWBBTS3wjZLC5lrSBh

# LImLhCqa0c10sjAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNV

# HR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2Ny

# bC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYI

# KwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy

# MDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA0G

# CSqGSIb3DQEBCwUAA4ICAQCvYAsQuCFW2ClUARz+c7SXP5H4Erm3C+YU0XlRNbsE

# lSqfdkn3fyCLxYBkHMFZQGXPA7mzoU7IZUdn0hXyuvrFM6DDrn/SLShe5t+PPkqW

# eOeYiEw8k4BI6l4U5k07wX8hBwOoMRxs1aOe/JNkLHO6krl5j6/GZHrkTRzTsRUU

# Jp1FpnUzixiZWyavc0x/imG5yWdrSuccE9ndoq7Qbu1Pxa7swsUm5zNNMunaWGXD

# FAnS7s8RxJ1/P3qTtZ0Ja6VE6SeoHpdj7/hPuKJLXV/M89GNFn8HUDmVW5+YK/8D

# y7yKHHiiSd+ugAN+pW3PA6OYek0ryW1QKzbrW4P9SXAk+U5faXjBJoitW98+ZERW

# X387VHvaTWJ4Yo5BmkJ0U27Aal2ggi5j1PYuDxB3DsofM+7ebc4zgJ0GF4u6DQW0

# V4rc/F2zytl2rDQfUGlPtNUymUZVbWJbFqw64je8QsAnMeG1J8ohxjYlea3iLAzG

# wime4dbMSyEHoObVvzIN0d9BJ84xVeXKvET176GhY/PS6RTJZiW5PPihZh88F3Je

# cEvhlct/FbpQPt+mhDOBQAyqjI1tdBQlBFVX85xWd1JRnUkuxqshXqFwcxKr8GiF

# sb9AV7y7TT30fmMTs3gmnojFQt3MdD5Q3M/gBf1TdlhyiPNXTgJhP6iyZHfxKZi2

# czCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQEL

# BQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNV

# BAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4X

# DTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3Rh

# bXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM

# 57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm

# 95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzB

# RMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBb

# fowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCO

# Mcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYw

# XE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW

# /aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/w

# EPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPK

# Z6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2

# BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfH

# CBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYB

# BAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8v

# BO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYM

# KwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0

# LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEF

# BQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD

# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBW

# BgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny

# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUH

# AQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtp

# L2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsF

# AAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518Jx

# Nj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+

# iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2

# pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefw

# C2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7

# T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFO

# Ry3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhL

# mm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3L

# wUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5

# m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE

# 0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggLLMIICNAIB

# ATCB+KGB0KSBzTCByjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x

# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEmMCQGA1UE

# CxMdVGhhbGVzIFRTUyBFU046QUUyQy1FMzJCLTFBRkMxJTAjBgNVBAMTHE1pY3Jv

# c29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAND6JppVWWnb

# irQx4Ic7QWQ35lb+oIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh

# c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD

# b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw

# MTAwDQYJKoZIhvcNAQEFBQACBQDnCdCmMCIYDzIwMjIxMDMxMTI0MjE0WhgPMjAy

# MjExMDExMjQyMTRaMHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAOcJ0KYCAQAwBwIB

# AAICFIswBwIBAAICEV4wCgIFAOcLIiYCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYK

# KwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUF

# AAOBgQB0oXDzPo/tAnTTxGfkkKAvTI2XJSMhm69MrtPH8bcHlDH5ovLj0D7dPmYk

# uzAqdWnaGvyWnoAICyIRW0t6REPf98e7UeXdJNH5GbkbN5WuZ+GX2xVzxPHrtFBi

# jjqJSug3+gD7/xzMqFKeTXII1IUa4j0+QESj6ohI1SZyXriuqjGCBA0wggQJAgEB

# MIGTMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNV

# BAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABlklbYuEv3fdP

# AAEAAAGWMA0GCWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcN

# AQkQAQQwLwYJKoZIhvcNAQkEMSIEIBh8hl10HMp/3FUFB/yGb4z+W35QV5OCp6vf

# 043AHcdlMIH6BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgdgTWAvgdNdOSdkcu

# gn52dCQPCX5WUEOrC6RyNy2yvZAwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEG

# A1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWlj

# cm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFt

# cCBQQ0EgMjAxMAITMwAAAZZJW2LhL933TwABAAABljAiBCBwkQ4mY8zG5iu+1hF9

# kcwM6FzSTyAmou9XIn7qMc9HfjANBgkqhkiG9w0BAQsFAASCAgC6fpDG6Oyleuky

# Q9mGUIbs82Rnlbm9h/XdGY/2VA0d2Pc/3wra5eTIHVlHLkHV9999oNcNwZR/O/vY

# QWarodvbVymABXxGzrWl/b+bPFdhwoTNXX1djLnOZQhgxOCYvq20LGiWZ9OlN0M1

# Z//txDkNev3Jt4BUOgoSYZGHD5OKOhjoj9XV2OeT+4FQRiWzH/k/Pu7vLQI04iml

# 79kTGyUs5dFK4eJmbhD1Rk5nKlEqNXrXvklgj3riFlr7y2iaoaEMZTEJiYe1wbdc

# +CRA/8/qmj3sTTDMLbseCkSgRZve5v2fjEgbZvmd+lqGo6CZY6WdNQUBz2DOdTtC

# vZP4ugW+7hg5R4uAAFy8E+H0vpyNcm6MDuj2OW116poPsglyDiC74C546iU9UJwQ

# QU6Rd7hfqQcTWEXf22Pnh1gJemNyiS7tWonI3aflez8vpOhrYH/Uo4UqDU0LF7H2

# bsKGiqDFZeFFHYg8hiqkLthEODCULi9Wuwu3mBEX8CPrfXZwF5arG34wTMJIdtFa

# DtoGitJc15rnlJhpP1slGmcP+nMucvd7V7VFrLz05u4At2mPkQFIIK0cdInkxSYK

# h3fTMnQkmsTk7cb75tYhZV/Eu/oyWrJ2QmPQsnQOAgHpkhvW1ZlDvcK8csNUzIOW

# lFFglSFSYVR2x5/LhZvDr+/iEnTqVQ==

# SIG # End signature block