mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Anand Krishnamoorthi
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
171 lines
5.2 KiB
YAML
171 lines
5.2 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: Cosmos DB/Cosmos_Locations_Deny
|
|
# Real Azure Policy: "Azure Cosmos DB allowed locations"
|
|
# Source: regolator/policyDefinitions/Cosmos DB/Cosmos_Locations_Deny.json
|
|
#
|
|
# Features exercised:
|
|
# - count with where clause
|
|
# - Chained template functions in where: replace(toLower(first(field(...))), ' ', '')
|
|
# - count result compared to length(field(...)) via notEquals
|
|
# - Parameterized effect with case-variant allowedValues
|
|
|
|
aliases: test_aliases.json
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Azure Cosmos DB allowed locations",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"listOfAllowedLocations": {
|
|
"type": "Array",
|
|
"metadata": {
|
|
"displayName": "Allowed locations",
|
|
"strongType": "location"
|
|
}
|
|
},
|
|
"policyEffect": {
|
|
"type": "String",
|
|
"allowedValues": ["audit", "Audit", "deny", "Deny", "disabled", "Disabled"],
|
|
"defaultValue": "Deny"
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.DocumentDB/databaseAccounts"
|
|
},
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.DocumentDB/databaseAccounts/Locations[*]",
|
|
"where": {
|
|
"value": "[replace(toLower(first(field('Microsoft.DocumentDB/databaseAccounts/Locations[*].locationName'))), ' ', '')]",
|
|
"in": "[parameters('listOfAllowedLocations')]"
|
|
}
|
|
},
|
|
"notEquals": "[length(field('Microsoft.DocumentDB/databaseAccounts/Locations[*]'))]"
|
|
}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('policyEffect')]"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# All locations allowed → pass
|
|
# =========================================================================
|
|
|
|
- note: pass_all_locations_in_allowed_list
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-compliant"
|
|
properties:
|
|
Locations:
|
|
- locationName: "East US"
|
|
- locationName: "West US"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus", "westus"]
|
|
want_undefined: true
|
|
|
|
- note: pass_single_location_allowed
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-single"
|
|
properties:
|
|
Locations:
|
|
- locationName: "East US"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus", "westus", "centralus"]
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Location not in allowed list → deny
|
|
# =========================================================================
|
|
|
|
- note: deny_location_not_allowed
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-bad-region"
|
|
properties:
|
|
Locations:
|
|
- locationName: "East US"
|
|
- locationName: "North Europe"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus", "westus"]
|
|
want_effect: "Deny"
|
|
|
|
- note: deny_all_locations_disallowed
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-all-bad"
|
|
properties:
|
|
Locations:
|
|
- locationName: "South East Asia"
|
|
- locationName: "Japan East"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus", "westus"]
|
|
want_effect: "Deny"
|
|
|
|
- note: deny_one_of_three_disallowed
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-one-bad"
|
|
properties:
|
|
Locations:
|
|
- locationName: "East US"
|
|
- locationName: "West US"
|
|
- locationName: "Brazil South"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus", "westus"]
|
|
want_effect: "Deny"
|
|
|
|
# =========================================================================
|
|
# Edge: location names with spaces normalized by replace+toLower
|
|
# =========================================================================
|
|
|
|
- note: pass_location_with_spaces_normalized
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-spaces"
|
|
properties:
|
|
Locations:
|
|
- locationName: "Central US"
|
|
parameters:
|
|
listOfAllowedLocations: ["centralus"]
|
|
want_undefined: true
|
|
|
|
- note: pass_mixed_case_location
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-case"
|
|
properties:
|
|
Locations:
|
|
- locationName: "EAST US"
|
|
parameters:
|
|
listOfAllowedLocations: ["eastus"]
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Wrong type
|
|
# =========================================================================
|
|
|
|
- note: pass_wrong_type
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "not-cosmos"
|
|
properties:
|
|
Locations:
|
|
- locationName: "East US"
|
|
parameters:
|
|
listOfAllowedLocations: ["westus"]
|
|
want_undefined: true
|