mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
131 lines
4.1 KiB
YAML
131 lines
4.1 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: Compute/DoubleEncryptionRequired_Deny
|
|
# Real Azure Policy: "Managed disks should be double encrypted with both
|
|
# platform-managed and customer-managed keys"
|
|
# Features: allOf, field (type + alias), equals, notEquals, parameters() with
|
|
# defaultValue and allowedValues, parameterized effect
|
|
|
|
aliases: test_aliases.json
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Managed disks should be double encrypted",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"effect": {
|
|
"type": "string",
|
|
"defaultValue": "Audit",
|
|
"allowedValues": ["Audit", "Deny", "Disabled"],
|
|
"metadata": {
|
|
"displayName": "Effect",
|
|
"description": "Enable or disable the execution of the policy"
|
|
}
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/diskEncryptionSets"
|
|
},
|
|
{
|
|
"field": "Microsoft.Compute/diskEncryptionSets/encryptionType",
|
|
"notEquals": "EncryptionAtRestWithPlatformAndCustomerKeys"
|
|
}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Audit (default effect) — wrong encryption type
|
|
# =========================================================================
|
|
|
|
- note: audit_single_key_encryption
|
|
resource:
|
|
type: "Microsoft.Compute/diskEncryptionSets"
|
|
name: "myDES"
|
|
location: "eastus"
|
|
properties:
|
|
encryptionType: "EncryptionAtRestWithCustomerKey"
|
|
want_effect: "Audit"
|
|
|
|
# =========================================================================
|
|
# No effect — correct double encryption
|
|
# =========================================================================
|
|
|
|
- note: pass_double_encryption
|
|
resource:
|
|
type: "Microsoft.Compute/diskEncryptionSets"
|
|
name: "myDES"
|
|
location: "eastus"
|
|
properties:
|
|
encryptionType: "EncryptionAtRestWithPlatformAndCustomerKeys"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# No effect — wrong resource type
|
|
# =========================================================================
|
|
|
|
- note: skip_wrong_type
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_D2s_v3"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Deny — explicit effect parameter override
|
|
# =========================================================================
|
|
|
|
- note: deny_with_explicit_effect
|
|
resource:
|
|
type: "Microsoft.Compute/diskEncryptionSets"
|
|
name: "myDES"
|
|
location: "westus"
|
|
properties:
|
|
encryptionType: "EncryptionAtRestWithCustomerKey"
|
|
parameters:
|
|
effect: "Deny"
|
|
want_effect: "Deny"
|
|
|
|
# =========================================================================
|
|
# Audit — platform-only encryption (not double)
|
|
# =========================================================================
|
|
|
|
- note: audit_platform_only_encryption
|
|
resource:
|
|
type: "Microsoft.Compute/diskEncryptionSets"
|
|
name: "platformDES"
|
|
location: "eastus"
|
|
properties:
|
|
encryptionType: "EncryptionAtRestWithPlatformKey"
|
|
want_effect: "Audit"
|
|
|
|
# =========================================================================
|
|
# No effect — encryption type missing (field is undefined/null)
|
|
# notEquals with null LHS: Azure Policy treats missing field as null,
|
|
# and null notEquals "string" is true → should fire
|
|
# =========================================================================
|
|
|
|
- note: audit_missing_encryption_type
|
|
resource:
|
|
type: "Microsoft.Compute/diskEncryptionSets"
|
|
name: "noPropDES"
|
|
location: "eastus"
|
|
properties: {}
|
|
want_effect: "Audit"
|