# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# E2E Test: Automanage/Deployv2
# Real Azure Policy: "Configure virtual machines to be onboarded to Azure Automanage"
# Source: regolator/policyDefinitions/Automanage/Deployv2.json
#
# Features exercised:
#   - 106 condition nodes (broad, depth 4) — wide register pressure test
#   - Dynamic tag field: [concat('tags[', parameters('inclusionTagName'), ']')]
#   - DeployIfNotExists with conditional deployment (VM vs Arc)
#   - Large hardcoded location list
#   - Extensive image publisher/offer/SKU matching

aliases: test_aliases.json

policy_definition: |
  {
    "properties": {
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "displayName": "Configure virtual machines to be onboarded to Azure Automanage",
      "description": "Azure Automanage enrolls, configures, and monitors virtual machines with best practice as defined in the Microsoft Cloud Adoption Framework for Azure. Use this policy to apply Automanage to your selected scope.",
      "version": "2.4.0",
      "parameters": {
        "configurationProfileAssignment": {
          "type": "String",
          "metadata": {
            "displayName": "Configuration profile",
            "description": "The management services provided are based on whether the machine is intended to be used in a dev/test environment or production."
          },
          "allowedValues": [
            "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesproduction",
            "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesdevtest"
          ],
          "defaultValue": "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesproduction"
        },
        "effect": {
          "type": "String",
          "metadata": {
            "displayName": "Effect",
            "description": "Enable or disable the execution of this policy"
          },
          "allowedValues": [
            "AuditIfNotExists",
            "DeployIfNotExists",
            "Disabled"
          ],
          "defaultValue": "DeployIfNotExists"
        },
        "inclusionTagName": {
          "type": "String",
          "metadata": {
            "displayName": "Inclusion Tag Name",
            "description": "Name of the tag to use for including VMs in the scope of this policy. This should be used along with the Inclusion Tag Value parameter."
          },
          "defaultValue": ""
        },
        "inclusionTagValues": {
          "type": "Array",
          "metadata": {
            "displayName": "Inclusion Tag Values",
            "description": "Value of the tag to use for including VMs in the scope of this policy (in case of multiple values, use a comma-separated list). This should be used along with the Inclusion Tag Name parameter."
          },
          "defaultValue": []
        }
      },
      "policyRule": {
        "if": {
          "allOf": [
            {
              "anyOf": [
                {
                  "field": "[concat('tags[', parameters('inclusionTagName'), ']')]",
                  "in": "[parameters('inclusionTagValues')]"
                },
                {
                  "value": "[empty(parameters('inclusionTagValues'))]",
                  "equals": "true"
                },
                {
                  "value": "[empty(parameters('inclusionTagName'))]",
                  "equals": "true"
                }
              ]
            },
            {
              "field": "location",
              "in": [
                "eastus",
                "eastus2",
                "westus",
                "westus2",
                "centralus",
                "southcentralus",
                "westcentralus",
                "northeurope",
                "westeurope",
                "canadacentral",
                "japaneast",
                "uksouth",
                "australiaeast",
                "australiasoutheast",
                "southeastasia"
              ]
            },
            {
              "field": "type",
              "in": [
                "Microsoft.Compute/virtualMachines",
                "Microsoft.HybridCompute/machines"
              ]
            },
            {
              "anyOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "in": [
                    "esri",
                    "incredibuild",
                    "MicrosoftDynamicsAX",
                    "MicrosoftSharepoint",
                    "MicrosoftVisualStudio",
                    "MicrosoftWindowsDesktop",
                    "MicrosoftWindowsServerHPCPack"
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "MicrosoftWindowsServer"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "2008*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "MicrosoftSQLServer"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "notLike": "SQL2008*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "microsoft-dsvm"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "equals": "dsvm-windows"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "microsoft-ads"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "standard-data-science-vm",
                        "windows-data-science-vm"
                      ]
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "batch"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "equals": "rendering-windows2016"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "center-for-internet-security-inc"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "cis-windows-server-201*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "pivotal"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "bosh-windows-server*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "cloud-infrastructure-services"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "ad*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "anyOf": [
                        {
                          "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
                          "exists": "true"
                        },
                        {
                          "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                          "like": "Windows*"
                        }
                      ]
                    },
                    {
                      "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id",
                      "exists": "true"
                    },
                    {
                      "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku",
                      "exists": "false"
                    }
                  ]
                },
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "in": [
                    "microsoft-aks",
                    "qubole-inc",
                    "datastax",
                    "couchbase",
                    "scalegrid",
                    "checkpoint",
                    "paloaltonetworks",
                    "debian"
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "OpenLogic"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "CentOS*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "6*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "OpenLogic"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "CentOS*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "8*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "RedHat"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "RHEL",
                        "RHEL-HA",
                        "RHEL-SAP",
                        "RHEL-SAP-APPS",
                        "RHEL-SAP-HA",
                        "RHEL-SAP-HANA",
                        "rhel-raw"
                      ]
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "6*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "RedHat"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "RHEL",
                        "RHEL-HA",
                        "RHEL-SAP",
                        "RHEL-SAP-APPS",
                        "RHEL-SAP-HA",
                        "RHEL-SAP-HANA",
                        "rhel-raw"
                      ]
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "8*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "RedHat"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "osa",
                        "rhel-byos"
                      ]
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "center-for-internet-security-inc"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "cis-centos-7-l1",
                        "cis-centos-7-v2-1-1-l1",
                        "cis-nginx-centos-7-v1-1-0-l1",
                        "cis-oracle-linux-7-v2-0-0-l1",
                        "cis-postgresql-11-centos-linux-7-level-1",
                        "cis-rhel-7-l2",
                        "cis-rhel-7-v2-2-0-l1",
                        "cis-suse-linux-12-v2-0-0-l1",
                        "cis-suse15-l1",
                        "cis-ubuntu-linux-1604-v1-0-0-l1",
                        "cis-ubuntu-linux-1804-l1",
                        "cis-ubuntu-linux-2004-l1"
                      ]
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "credativ"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "Suse"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "SLES*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "11*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "Canonical"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "equals": "UbuntuServer"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "12*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "microsoft-dsvm"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "in": [
                        "linux-data-science-vm-ubuntu",
                        "azureml"
                      ]
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "cloudera"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "equals": "cloudera-centos-os"
                    },
                    {
                      "field": "Microsoft.Compute/imageSKU",
                      "notLike": "6*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "cloudera"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "equals": "cloudera-altus-centos-os"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "equals": "microsoft-ads"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "linux*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "anyOf": [
                        {
                          "field": "Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration",
                          "exists": "true"
                        },
                        {
                          "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                          "like": "Linux*"
                        }
                      ]
                    },
                    {
                      "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id",
                      "exists": "true"
                    },
                    {
                      "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku",
                      "exists": "false"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "CentOS*"
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "notLike": "Linux 6*"
                    }
                  ]
                },
                {
                  "allOf": [
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Windows Server*"
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "notLike": "2008*"
                    }
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Red Hat Enterprise Linux 8.*"
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Red Hat Enterprise Linux 7.*"
                    }
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Ubuntu 18.04*"
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Ubuntu 16.04*"
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "Ubuntu 20.04*"
                    }
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "in": [
                        "SUSE Linux Enterprise Server 12 SP3",
                        "SUSE Linux Enterprise Server 12 SP4",
                        "SUSE Linux Enterprise Server 12 SP5"
                      ]
                    },
                    {
                      "field": "Microsoft.HybridCompute/machines/osSku",
                      "like": "SUSE Linux Enterprise Server 15*"
                    }
                  ]
                }
              ]
            }
          ]
        },
        "then": {
          "effect": "[parameters('effect')]",
          "details": {
            "roleDefinitionIds": [
              "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "type": "Microsoft.Automanage/configurationProfileAssignments",
            "name": "default",
            "existenceCondition": {
              "allOf": [
                {
                  "field": "Microsoft.Automanage/configurationProfileAssignments/configurationProfile",
                  "equals": "[parameters('configurationProfileAssignment')]"
                }
              ]
            },
            "deployment": {
              "properties": {
                "mode": "incremental",
                "parameters": {
                  "machineName": {
                    "value": "[field('Name')]"
                  },
                  "resourceType": {
                    "value": "[field('Type')]"
                  },
                  "configurationProfileAssignment": {
                    "value": "[parameters('configurationProfileAssignment')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "parameters": {
                    "machineName": {
                      "type": "String"
                    },
                    "resourceType": {
                      "type": "String"
                    },
                    "configurationProfileAssignment": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "condition": "[equals(toLower(parameters('resourceType')), 'microsoft.compute/virtualmachines')]",
                      "type": "Microsoft.Compute/virtualMachines/providers/configurationProfileAssignments",
                      "apiVersion": "2022-05-04",
                      "name": "[concat(parameters('machineName'), '/Microsoft.Automanage/', 'default')]",
                      "properties": {
                        "configurationProfile": "[parameters('configurationProfileAssignment')]"
                      }
                    },
                    {
                      "condition": "[equals(toLower(parameters('resourceType')), 'microsoft.hybridcompute/machines')]",
                      "type": "Microsoft.HybridCompute/machines/providers/configurationProfileAssignments",
                      "apiVersion": "2022-05-04",
                      "name": "[concat(parameters('machineName'), '/Microsoft.Automanage/', 'default')]",
                      "properties": {
                        "configurationProfile": "[parameters('configurationProfileAssignment')]"
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  }

cases:
  # =========================================================================
  # DINE — Windows VM in supported region, matching publisher
  # =========================================================================

  - note: dine_windows_vm_canonical
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "win-vm-01"
      id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/win-vm-01"
      location: "eastus"
      properties:
        storageProfile:
          imageReference:
            publisher: "MicrosoftWindowsServer"
            offer: "WindowsServer"
            sku: "2019-Datacenter"
          osDisk:
            osType: "Windows"
        osProfile:
          windowsConfiguration: {}
    host_await:
      - key:
          operation: "lookup_related_resources"
          type: "Microsoft.Automanage/configurationProfileAssignments"
          name: "default"
        response: null
    want_effect: "DeployIfNotExists"

  # =========================================================================
  # Pass — VM in unsupported region
  # =========================================================================

  - note: pass_unsupported_region
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "vm-brazil"
      location: "brazilsoutheast"
      properties:
        storageProfile:
          imageReference:
            publisher: "MicrosoftWindowsServer"
            offer: "WindowsServer"
            sku: "2019-Datacenter"
          osDisk:
            osType: "Windows"
        osProfile:
          windowsConfiguration: {}
    want_undefined: true

  # =========================================================================
  # DINE — Linux VM with Canonical publisher
  # =========================================================================

  - note: dine_linux_vm_canonical
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "linux-vm-01"
      id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/linux-vm-01"
      location: "westus2"
      properties:
        storageProfile:
          imageReference:
            publisher: "Canonical"
            offer: "UbuntuServer"
            sku: "18.04-LTS"
          osDisk:
            osType: "Linux"
        osProfile:
          linuxConfiguration: {}
    host_await:
      - key:
          operation: "lookup_related_resources"
          type: "Microsoft.Automanage/configurationProfileAssignments"
          name: "default"
        response: null
    want_effect: "DeployIfNotExists"

  # =========================================================================
  # Pass — VM with tag filter that doesn't match
  # =========================================================================

  - note: pass_tag_filter_no_match
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "vm-tagged"
      location: "eastus"
      tags:
        env: "dev"
      properties:
        storageProfile:
          imageReference:
            publisher: "MicrosoftWindowsServer"
            offer: "WindowsServer"
            sku: "2019-Datacenter"
          osDisk:
            osType: "Windows"
        osProfile:
          windowsConfiguration: {}
    parameters:
      inclusionTagName: "env"
      inclusionTagValues:
        - "prod"
    want_undefined: true

  # =========================================================================
  # Skip — Wrong resource type
  # =========================================================================

  - note: skip_wrong_type
    resource:
      type: "Microsoft.Storage/storageAccounts"
      name: "storageacct1"
      location: "eastus"
      properties: {}
    want_undefined: true

  # =========================================================================
  # Pass — VM with unsupported publisher (not in any publisher allowlist)
  # =========================================================================

  - note: pass_unsupported_publisher
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "vm-unknown-pub"
      id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm-unknown-pub"
      location: "eastus"
      properties:
        storageProfile:
          imageReference:
            publisher: "unknown-vendor"
            offer: "some-offer"
            sku: "some-sku"
          osDisk:
            osType: "Linux"
        osProfile:
          linuxConfiguration: {}
    want_undefined: true
