# Copyright (c) Microsoft Corporation. # Licensed under the MIT License. # E2E Test: Automanage/Deployv2 # Real Azure Policy: "Configure virtual machines to be onboarded to Azure Automanage" # Source: regolator/policyDefinitions/Automanage/Deployv2.json # # Features exercised: # - 106 condition nodes (broad, depth 4) — wide register pressure test # - Dynamic tag field: [concat('tags[', parameters('inclusionTagName'), ']')] # - DeployIfNotExists with conditional deployment (VM vs Arc) # - Large hardcoded location list # - Extensive image publisher/offer/SKU matching aliases: test_aliases.json policy_definition: | { "properties": { "policyType": "BuiltIn", "mode": "Indexed", "displayName": "Configure virtual machines to be onboarded to Azure Automanage", "description": "Azure Automanage enrolls, configures, and monitors virtual machines with best practice as defined in the Microsoft Cloud Adoption Framework for Azure. Use this policy to apply Automanage to your selected scope.", "version": "2.4.0", "parameters": { "configurationProfileAssignment": { "type": "String", "metadata": { "displayName": "Configuration profile", "description": "The management services provided are based on whether the machine is intended to be used in a dev/test environment or production." }, "allowedValues": [ "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesproduction", "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesdevtest" ], "defaultValue": "/providers/Microsoft.Automanage/bestPractices/azurebestpracticesproduction" }, "effect": { "type": "String", "metadata": { "displayName": "Effect", "description": "Enable or disable the execution of this policy" }, "allowedValues": [ "AuditIfNotExists", "DeployIfNotExists", "Disabled" ], "defaultValue": "DeployIfNotExists" }, "inclusionTagName": { "type": "String", "metadata": { "displayName": "Inclusion Tag Name", "description": "Name of the tag to use for including VMs in the scope of this policy. This should be used along with the Inclusion Tag Value parameter." }, "defaultValue": "" }, "inclusionTagValues": { "type": "Array", "metadata": { "displayName": "Inclusion Tag Values", "description": "Value of the tag to use for including VMs in the scope of this policy (in case of multiple values, use a comma-separated list). This should be used along with the Inclusion Tag Name parameter." }, "defaultValue": [] } }, "policyRule": { "if": { "allOf": [ { "anyOf": [ { "field": "[concat('tags[', parameters('inclusionTagName'), ']')]", "in": "[parameters('inclusionTagValues')]" }, { "value": "[empty(parameters('inclusionTagValues'))]", "equals": "true" }, { "value": "[empty(parameters('inclusionTagName'))]", "equals": "true" } ] }, { "field": "location", "in": [ "eastus", "eastus2", "westus", "westus2", "centralus", "southcentralus", "westcentralus", "northeurope", "westeurope", "canadacentral", "japaneast", "uksouth", "australiaeast", "australiasoutheast", "southeastasia" ] }, { "field": "type", "in": [ "Microsoft.Compute/virtualMachines", "Microsoft.HybridCompute/machines" ] }, { "anyOf": [ { "field": "Microsoft.Compute/imagePublisher", "in": [ "esri", "incredibuild", "MicrosoftDynamicsAX", "MicrosoftSharepoint", "MicrosoftVisualStudio", "MicrosoftWindowsDesktop", "MicrosoftWindowsServerHPCPack" ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "MicrosoftWindowsServer" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "2008*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "MicrosoftSQLServer" }, { "field": "Microsoft.Compute/imageOffer", "notLike": "SQL2008*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "microsoft-dsvm" }, { "field": "Microsoft.Compute/imageOffer", "equals": "dsvm-windows" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "microsoft-ads" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "standard-data-science-vm", "windows-data-science-vm" ] } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "batch" }, { "field": "Microsoft.Compute/imageOffer", "equals": "rendering-windows2016" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "center-for-internet-security-inc" }, { "field": "Microsoft.Compute/imageOffer", "like": "cis-windows-server-201*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "pivotal" }, { "field": "Microsoft.Compute/imageOffer", "like": "bosh-windows-server*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "cloud-infrastructure-services" }, { "field": "Microsoft.Compute/imageOffer", "like": "ad*" } ] }, { "allOf": [ { "anyOf": [ { "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration", "exists": "true" }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", "like": "Windows*" } ] }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id", "exists": "true" }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", "exists": "false" } ] }, { "field": "Microsoft.Compute/imagePublisher", "in": [ "microsoft-aks", "qubole-inc", "datastax", "couchbase", "scalegrid", "checkpoint", "paloaltonetworks", "debian" ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "OpenLogic" }, { "field": "Microsoft.Compute/imageOffer", "like": "CentOS*" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "6*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "OpenLogic" }, { "field": "Microsoft.Compute/imageOffer", "like": "CentOS*" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "8*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "RedHat" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "RHEL", "RHEL-HA", "RHEL-SAP", "RHEL-SAP-APPS", "RHEL-SAP-HA", "RHEL-SAP-HANA", "rhel-raw" ] }, { "field": "Microsoft.Compute/imageSKU", "notLike": "6*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "RedHat" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "RHEL", "RHEL-HA", "RHEL-SAP", "RHEL-SAP-APPS", "RHEL-SAP-HA", "RHEL-SAP-HANA", "rhel-raw" ] }, { "field": "Microsoft.Compute/imageSKU", "notLike": "8*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "RedHat" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "osa", "rhel-byos" ] } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "center-for-internet-security-inc" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "cis-centos-7-l1", "cis-centos-7-v2-1-1-l1", "cis-nginx-centos-7-v1-1-0-l1", "cis-oracle-linux-7-v2-0-0-l1", "cis-postgresql-11-centos-linux-7-level-1", "cis-rhel-7-l2", "cis-rhel-7-v2-2-0-l1", "cis-suse-linux-12-v2-0-0-l1", "cis-suse15-l1", "cis-ubuntu-linux-1604-v1-0-0-l1", "cis-ubuntu-linux-1804-l1", "cis-ubuntu-linux-2004-l1" ] } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "credativ" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "Suse" }, { "field": "Microsoft.Compute/imageOffer", "like": "SLES*" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "11*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "Canonical" }, { "field": "Microsoft.Compute/imageOffer", "equals": "UbuntuServer" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "12*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "microsoft-dsvm" }, { "field": "Microsoft.Compute/imageOffer", "in": [ "linux-data-science-vm-ubuntu", "azureml" ] } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "cloudera" }, { "field": "Microsoft.Compute/imageOffer", "equals": "cloudera-centos-os" }, { "field": "Microsoft.Compute/imageSKU", "notLike": "6*" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "cloudera" }, { "field": "Microsoft.Compute/imageOffer", "equals": "cloudera-altus-centos-os" } ] }, { "allOf": [ { "field": "Microsoft.Compute/imagePublisher", "equals": "microsoft-ads" }, { "field": "Microsoft.Compute/imageOffer", "like": "linux*" } ] }, { "allOf": [ { "anyOf": [ { "field": "Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration", "exists": "true" }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", "like": "Linux*" } ] }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id", "exists": "true" }, { "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", "exists": "false" } ] }, { "allOf": [ { "field": "Microsoft.HybridCompute/machines/osSku", "like": "CentOS*" }, { "field": "Microsoft.HybridCompute/machines/osSku", "notLike": "Linux 6*" } ] }, { "allOf": [ { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Windows Server*" }, { "field": "Microsoft.HybridCompute/machines/osSku", "notLike": "2008*" } ] }, { "anyOf": [ { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Red Hat Enterprise Linux 8.*" }, { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Red Hat Enterprise Linux 7.*" } ] }, { "anyOf": [ { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Ubuntu 18.04*" }, { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Ubuntu 16.04*" }, { "field": "Microsoft.HybridCompute/machines/osSku", "like": "Ubuntu 20.04*" } ] }, { "anyOf": [ { "field": "Microsoft.HybridCompute/machines/osSku", "in": [ "SUSE Linux Enterprise Server 12 SP3", "SUSE Linux Enterprise Server 12 SP4", "SUSE Linux Enterprise Server 12 SP5" ] }, { "field": "Microsoft.HybridCompute/machines/osSku", "like": "SUSE Linux Enterprise Server 15*" } ] } ] } ] }, "then": { "effect": "[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Automanage/configurationProfileAssignments", "name": "default", "existenceCondition": { "allOf": [ { "field": "Microsoft.Automanage/configurationProfileAssignments/configurationProfile", "equals": "[parameters('configurationProfileAssignment')]" } ] }, "deployment": { "properties": { "mode": "incremental", "parameters": { "machineName": { "value": "[field('Name')]" }, "resourceType": { "value": "[field('Type')]" }, "configurationProfileAssignment": { "value": "[parameters('configurationProfileAssignment')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "machineName": { "type": "String" }, "resourceType": { "type": "String" }, "configurationProfileAssignment": { "type": "string" } }, "resources": [ { "condition": "[equals(toLower(parameters('resourceType')), 'microsoft.compute/virtualmachines')]", "type": "Microsoft.Compute/virtualMachines/providers/configurationProfileAssignments", "apiVersion": "2022-05-04", "name": "[concat(parameters('machineName'), '/Microsoft.Automanage/', 'default')]", "properties": { "configurationProfile": "[parameters('configurationProfileAssignment')]" } }, { "condition": "[equals(toLower(parameters('resourceType')), 'microsoft.hybridcompute/machines')]", "type": "Microsoft.HybridCompute/machines/providers/configurationProfileAssignments", "apiVersion": "2022-05-04", "name": "[concat(parameters('machineName'), '/Microsoft.Automanage/', 'default')]", "properties": { "configurationProfile": "[parameters('configurationProfileAssignment')]" } } ] } } } } } } } } cases: # ========================================================================= # DINE — Windows VM in supported region, matching publisher # ========================================================================= - note: dine_windows_vm_canonical resource: type: "Microsoft.Compute/virtualMachines" name: "win-vm-01" id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/win-vm-01" location: "eastus" properties: storageProfile: imageReference: publisher: "MicrosoftWindowsServer" offer: "WindowsServer" sku: "2019-Datacenter" osDisk: osType: "Windows" osProfile: windowsConfiguration: {} host_await: - key: operation: "lookup_related_resources" type: "Microsoft.Automanage/configurationProfileAssignments" name: "default" response: null want_effect: "DeployIfNotExists" # ========================================================================= # Pass — VM in unsupported region # ========================================================================= - note: pass_unsupported_region resource: type: "Microsoft.Compute/virtualMachines" name: "vm-brazil" location: "brazilsoutheast" properties: storageProfile: imageReference: publisher: "MicrosoftWindowsServer" offer: "WindowsServer" sku: "2019-Datacenter" osDisk: osType: "Windows" osProfile: windowsConfiguration: {} want_undefined: true # ========================================================================= # DINE — Linux VM with Canonical publisher # ========================================================================= - note: dine_linux_vm_canonical resource: type: "Microsoft.Compute/virtualMachines" name: "linux-vm-01" id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/linux-vm-01" location: "westus2" properties: storageProfile: imageReference: publisher: "Canonical" offer: "UbuntuServer" sku: "18.04-LTS" osDisk: osType: "Linux" osProfile: linuxConfiguration: {} host_await: - key: operation: "lookup_related_resources" type: "Microsoft.Automanage/configurationProfileAssignments" name: "default" response: null want_effect: "DeployIfNotExists" # ========================================================================= # Pass — VM with tag filter that doesn't match # ========================================================================= - note: pass_tag_filter_no_match resource: type: "Microsoft.Compute/virtualMachines" name: "vm-tagged" location: "eastus" tags: env: "dev" properties: storageProfile: imageReference: publisher: "MicrosoftWindowsServer" offer: "WindowsServer" sku: "2019-Datacenter" osDisk: osType: "Windows" osProfile: windowsConfiguration: {} parameters: inclusionTagName: "env" inclusionTagValues: - "prod" want_undefined: true # ========================================================================= # Skip — Wrong resource type # ========================================================================= - note: skip_wrong_type resource: type: "Microsoft.Storage/storageAccounts" name: "storageacct1" location: "eastus" properties: {} want_undefined: true # ========================================================================= # Pass — VM with unsupported publisher (not in any publisher allowlist) # ========================================================================= - note: pass_unsupported_publisher resource: type: "Microsoft.Compute/virtualMachines" name: "vm-unknown-pub" id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm-unknown-pub" location: "eastus" properties: storageProfile: imageReference: publisher: "unknown-vendor" offer: "some-offer" sku: "some-sku" osDisk: osType: "Linux" osProfile: linuxConfiguration: {} want_undefined: true