# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# E2E Test: Compute/VMSkusAllowed_Deny
# Real Azure Policy: "Allowed virtual machine size SKUs"
# Features: allOf, not, field (type + alias), equals, in, parameters()

aliases: test_aliases.json

policy_definition: |
  {
    "properties": {
      "displayName": "Allowed virtual machine size SKUs",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "parameters": {
        "listOfAllowedSKUs": {
          "type": "Array",
          "metadata": {
            "displayName": "Allowed Size SKUs"
          }
        }
      },
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "not": {
                "field": "Microsoft.Compute/virtualMachines/sku.name",
                "in": "[parameters('listOfAllowedSKUs')]"
              }
            }
          ]
        },
        "then": {
          "effect": "Deny"
        }
      }
    }
  }

cases:
  # =========================================================================
  # Deny — VM SKU not in allowed list
  # =========================================================================

  - note: deny_disallowed_sku
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "myVM"
      location: "eastus"
      properties:
        hardwareProfile:
          vmSize: "Standard_E64i_v3"
    parameters:
      listOfAllowedSKUs:
        - "Standard_D2s_v3"
        - "Standard_D4s_v3"
        - "Standard_D8s_v3"
    want_effect: "Deny"

  # =========================================================================
  # No effect — VM SKU is in allowed list
  # =========================================================================

  - note: allow_permitted_sku
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "myVM"
      location: "eastus"
      properties:
        hardwareProfile:
          vmSize: "Standard_D4s_v3"
    parameters:
      listOfAllowedSKUs:
        - "Standard_D2s_v3"
        - "Standard_D4s_v3"
        - "Standard_D8s_v3"
    want_undefined: true

  # =========================================================================
  # No effect — wrong resource type (not a VM)
  # =========================================================================

  - note: skip_wrong_resource_type
    resource:
      type: "Microsoft.Storage/storageAccounts"
      name: "myStorage"
      location: "eastus"
      properties: {}
    parameters:
      listOfAllowedSKUs:
        - "Standard_D2s_v3"
    want_undefined: true

  # =========================================================================
  # Deny — single allowed SKU, VM doesn't match
  # =========================================================================

  - note: deny_single_allowed_sku
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "bigVM"
      location: "westus"
      properties:
        hardwareProfile:
          vmSize: "Standard_M128s"
    parameters:
      listOfAllowedSKUs:
        - "Standard_B1s"
    want_effect: "Deny"

  # =========================================================================
  # No effect — empty allowed list means everything blocked? No: `in` with
  # empty array is always false → not(false)=true → Deny.
  # =========================================================================

  - note: deny_empty_allowed_list
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "anyVM"
      location: "eastus"
      properties:
        hardwareProfile:
          vmSize: "Standard_D2s_v3"
    parameters:
      listOfAllowedSKUs: []
    want_effect: "Deny"

  # =========================================================================
  # Case sensitivity — SKU names are compared case-insensitively by the
  # `in` operator (Azure Policy string comparison semantics)
  # =========================================================================

  - note: allow_case_insensitive_sku
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "myVM"
      location: "eastus"
      properties:
        hardwareProfile:
          vmSize: "standard_d4s_v3"
    parameters:
      listOfAllowedSKUs:
        - "Standard_D4s_v3"
    want_undefined: true