mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
7f42115b63
YAML-driven test cases for the core Azure Policy compiler. These cover alias resolution, field conditions, logical operators, type coercion, count expressions, template functions, effect compilation, and policy definition parsing. 24 files, each a self-contained scenario exercised by the test runner in the companion code PR. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1132 lines
32 KiB
YAML
1132 lines
32 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# Alias Resolution Test Suite
|
|
# Tests alias-to-short-name resolution, normalization of ARM resource JSON,
|
|
# and correct field access through aliases across different resource types
|
|
# and alias patterns (scalar, nested, wildcard arrays, sub-resources, sku.*).
|
|
|
|
aliases: test_aliases.json
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Scalar alias — properties-flattened path
|
|
# =========================================================================
|
|
|
|
- note: alias_scalar_properties_flat
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: "deny"
|
|
|
|
- note: alias_scalar_properties_flat_false
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: false
|
|
want_undefined: true
|
|
|
|
- note: alias_scalar_properties_missing_field
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties: {}
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Nested alias — dotted path inside properties
|
|
# =========================================================================
|
|
|
|
- note: alias_nested_dotted_path
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/customDomain.name",
|
|
"equals": "cdn.contoso.com"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
customDomain:
|
|
name: "cdn.contoso.com"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_nested_dotted_path_mismatch
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/customDomain.name",
|
|
"equals": "cdn.contoso.com"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
customDomain:
|
|
name: "other.example.com"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# SKU alias — non-properties root path
|
|
# =========================================================================
|
|
|
|
- note: alias_sku_root_path
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/sku.name",
|
|
"equals": "Standard_LRS"
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
sku:
|
|
name: "Standard_LRS"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_sku_not_in_list
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"field": "Microsoft.Storage/storageAccounts/sku.name",
|
|
"in": ["Standard_LRS", "Standard_GRS"]
|
|
}
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
sku:
|
|
name: "Premium_LRS"
|
|
want_effect: "deny"
|
|
|
|
# =========================================================================
|
|
# Encryption alias — deeply nested properties path
|
|
# =========================================================================
|
|
|
|
- note: alias_deep_nested_encryption
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/enableBlobEncryption",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
encryption:
|
|
services:
|
|
blob:
|
|
enabled: true
|
|
want_effect: "audit"
|
|
|
|
- note: alias_deep_nested_encryption_false
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/enableBlobEncryption",
|
|
"notEquals": true
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
encryption:
|
|
services:
|
|
blob:
|
|
enabled: false
|
|
want_effect: "deny"
|
|
|
|
# =========================================================================
|
|
# Network ACLs alias — nested non-array path
|
|
# =========================================================================
|
|
|
|
- note: alias_network_acls_default_action
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
|
|
"notEquals": "Deny"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
defaultAction: "Allow"
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# Wildcard array alias — ipRules[*] (NOT a sub-resource; no properties flattening)
|
|
# =========================================================================
|
|
|
|
- note: alias_wildcard_array_ip_rules_count
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*]"
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
ipRules:
|
|
- value: "10.0.0.0/24"
|
|
action: "Allow"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_wildcard_array_ip_rules_where
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*]",
|
|
"where": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*].value",
|
|
"equals": "10.0.0.0/24"
|
|
}
|
|
},
|
|
"equals": 1
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
ipRules:
|
|
- value: "10.0.0.0/24"
|
|
action: "Allow"
|
|
- value: "192.168.1.0/24"
|
|
action: "Allow"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_wildcard_array_ip_rules_empty
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*]"
|
|
},
|
|
"equals": 0
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
ipRules: []
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# Sub-resource alias — NSG securityRules[*] (properties flattening)
|
|
# =========================================================================
|
|
|
|
- note: alias_sub_resource_nsg_protocol
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].protocol",
|
|
"equals": "Tcp"
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "allow-ssh"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_sub_resource_nsg_no_match
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].protocol",
|
|
"equals": "Udp"
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "allow-ssh"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
want_undefined: true
|
|
|
|
- note: alias_sub_resource_nsg_multiple_rules
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"allOf": [
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
|
|
"equals": "Allow"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
|
|
"equals": "Inbound"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"equals": 2
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "rule1"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
- name: "rule2"
|
|
properties:
|
|
protocol: "Udp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
- name: "rule3"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Deny"
|
|
direction: "Outbound"
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# Child resource alias — securityRules (non-array, single rule resource)
|
|
# =========================================================================
|
|
|
|
- note: alias_child_resource_security_rule_access
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Network/networkSecurityGroups/securityRules"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
|
|
"equals": "Allow"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups/securityRules"
|
|
properties:
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_child_resource_security_rule_direction
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Network/networkSecurityGroups/securityRules"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
|
|
"equals": "Outbound"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups/securityRules"
|
|
properties:
|
|
direction: "Inbound"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# VM alias — deeply nested storage/OS profiles
|
|
# =========================================================================
|
|
|
|
- note: alias_vm_hardware_profile
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Compute/virtualMachines/hardwareProfile.vmSize",
|
|
"equals": "Standard_D2s_v3"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_D2s_v3"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_vm_managed_disk_type
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.storageAccountType",
|
|
"notEquals": "Premium_LRS"
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
storageProfile:
|
|
osDisk:
|
|
managedDisk:
|
|
storageAccountType: "Standard_LRS"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_vm_data_disks_wildcard
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*]",
|
|
"where": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.storageAccountType",
|
|
"notEquals": "Premium_LRS"
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
storageProfile:
|
|
dataDisks:
|
|
- diskSizeGB: 128
|
|
managedDisk:
|
|
storageAccountType: "Standard_LRS"
|
|
- diskSizeGB: 256
|
|
managedDisk:
|
|
storageAccountType: "Premium_LRS"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_vm_data_disks_all_premium
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*]",
|
|
"where": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.storageAccountType",
|
|
"notEquals": "Premium_LRS"
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
storageProfile:
|
|
dataDisks:
|
|
- diskSizeGB: 128
|
|
managedDisk:
|
|
storageAccountType: "Premium_LRS"
|
|
- diskSizeGB: 256
|
|
managedDisk:
|
|
storageAccountType: "Premium_LRS"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# KeyVault alias — scalar + nested
|
|
# =========================================================================
|
|
|
|
- note: alias_keyvault_create_mode
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.KeyVault/vaults"
|
|
},
|
|
{
|
|
"field": "Microsoft.KeyVault/vaults/createMode",
|
|
"notEquals": "recover"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
properties:
|
|
createMode: "default"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_keyvault_recover_mode_no_match
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.KeyVault/vaults"
|
|
},
|
|
{
|
|
"field": "Microsoft.KeyVault/vaults/createMode",
|
|
"notEquals": "recover"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
properties:
|
|
createMode: "recover"
|
|
want_undefined: true
|
|
|
|
- note: alias_keyvault_network_acls
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.KeyVault/vaults"
|
|
},
|
|
{
|
|
"field": "Microsoft.KeyVault/vaults/networkAcls.defaultAction",
|
|
"notEquals": "Deny"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
properties:
|
|
networkAcls:
|
|
defaultAction: "Allow"
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# Case-insensitive alias matching
|
|
# =========================================================================
|
|
|
|
- note: alias_case_insensitive_match
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "microsoft.storage/storageaccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: "deny"
|
|
|
|
- note: alias_mixed_case_match
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "MICROSOFT.STORAGE/STORAGEACCOUNTS/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: "deny"
|
|
|
|
# =========================================================================
|
|
# Multiple aliases in same condition (allOf)
|
|
# =========================================================================
|
|
|
|
- note: alias_multiple_aliases_allof
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
|
|
"equals": "Deny"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
networkAcls:
|
|
defaultAction: "Deny"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_multiple_aliases_one_fails
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
},
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
|
|
"equals": "Deny"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
networkAcls:
|
|
defaultAction: "Allow"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Alias with exists operator
|
|
# =========================================================================
|
|
|
|
- note: alias_exists_true
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/isHnsEnabled",
|
|
"exists": true
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
isHnsEnabled: true
|
|
want_effect: "audit"
|
|
|
|
- note: alias_exists_false_when_missing
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/isHnsEnabled",
|
|
"exists": false
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties: {}
|
|
want_effect: "audit"
|
|
|
|
- note: alias_exists_true_when_missing
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/isHnsEnabled",
|
|
"exists": true
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties: {}
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Alias with not operator
|
|
# =========================================================================
|
|
|
|
- note: alias_not_operator
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
}
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: false
|
|
want_effect: "deny"
|
|
|
|
- note: alias_not_operator_negation
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
|
|
"equals": true
|
|
}
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Alias with contains/like operators
|
|
# =========================================================================
|
|
|
|
- note: alias_contains_operator
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/accessTier",
|
|
"contains": "Ho"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
accessTier: "Hot"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_like_operator
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/accessTier",
|
|
"like": "H*"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
accessTier: "Hot"
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# Alias with object parent (whole object)
|
|
# =========================================================================
|
|
|
|
- note: alias_object_parent
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/customDomain",
|
|
"exists": true
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
customDomain:
|
|
name: "cdn.contoso.com"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_object_parent_missing
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Storage/storageAccounts/customDomain",
|
|
"exists": false
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties: {}
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# VM image reference alias (deep nested, no sub-resource)
|
|
# =========================================================================
|
|
|
|
- note: alias_vm_image_publisher
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher",
|
|
"equals": "Canonical"
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
storageProfile:
|
|
imageReference:
|
|
publisher: "Canonical"
|
|
offer: "UbuntuServer"
|
|
want_effect: "audit"
|
|
|
|
- note: alias_vm_image_offer
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.offer",
|
|
"notEquals": "WindowsServer"
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
storageProfile:
|
|
imageReference:
|
|
publisher: "Canonical"
|
|
offer: "UbuntuServer"
|
|
want_effect: "deny"
|
|
|
|
# =========================================================================
|
|
# Cross-resource-type alias test (SQL Server auditing)
|
|
# =========================================================================
|
|
|
|
- note: alias_sql_server_auditing
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Sql/servers"
|
|
},
|
|
{
|
|
"field": "Microsoft.Sql/servers/state",
|
|
"equals": "Ready"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
properties:
|
|
state: "Ready"
|
|
want_effect: "audit"
|
|
|
|
# =========================================================================
|
|
# NSG sub-resource: securityRules[*].name — not under properties in ARM
|
|
# =========================================================================
|
|
|
|
- note: alias_nsg_rule_name_not_in_properties
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].name",
|
|
"equals": "allow-rdp"
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "allow-rdp"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
- name: "allow-ssh"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
want_effect: "deny"
|
|
|
|
# =========================================================================
|
|
# NSG sub-resource: complex where with nested allOf/anyOf
|
|
# =========================================================================
|
|
|
|
- note: alias_nsg_complex_where
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"allOf": [
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
|
|
"equals": "Allow"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
|
|
"equals": "Inbound"
|
|
},
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
|
|
"equals": "3389"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
|
|
"equals": "22"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "allow-rdp"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
destinationPortRange: "3389"
|
|
- name: "allow-https"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
destinationPortRange: "443"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_nsg_complex_where_no_dangerous_ports
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"allOf": [
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
|
|
"equals": "Allow"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
|
|
"equals": "Inbound"
|
|
},
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
|
|
"equals": "3389"
|
|
},
|
|
{
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
|
|
"equals": "22"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"greater": 0
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
properties:
|
|
securityRules:
|
|
- name: "allow-https"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
destinationPortRange: "443"
|
|
- name: "allow-http"
|
|
properties:
|
|
protocol: "Tcp"
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
destinationPortRange: "80"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Alias combined with type gate
|
|
# =========================================================================
|
|
|
|
- note: alias_with_type_gate_match
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
{
|
|
"field": "Microsoft.Compute/virtualMachines/hardwareProfile.vmSize",
|
|
"notIn": ["Standard_D2s_v3", "Standard_D4s_v3"]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_E64i_v3"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_with_type_gate_no_match_wrong_type
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
{
|
|
"field": "Microsoft.Compute/virtualMachines/hardwareProfile.vmSize",
|
|
"notIn": ["Standard_D2s_v3", "Standard_D4s_v3"]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_E64i_v3"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Alias with greaterOrEquals / lessOrEquals number operators
|
|
# =========================================================================
|
|
|
|
- note: alias_numeric_greater_or_equals
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*]"
|
|
},
|
|
"greaterOrEquals": 3
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
ipRules:
|
|
- value: "10.0.0.0/24"
|
|
- value: "10.0.1.0/24"
|
|
- value: "10.0.2.0/24"
|
|
want_effect: "deny"
|
|
|
|
- note: alias_numeric_less_or_equals
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"count": {
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules[*]"
|
|
},
|
|
"lessOrEquals": 1
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
properties:
|
|
networkAcls:
|
|
ipRules:
|
|
- value: "10.0.0.0/24"
|
|
want_effect: "audit"
|