mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
119 lines
3.9 KiB
YAML
119 lines
3.9 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: Cosmos DB/Cosmos_PrivateNetworkAccess_Modify
|
|
# Real Azure Policy: "Configure CosmosDB accounts to disable public network access"
|
|
# Source: regolator/policyDefinitions/Cosmos DB/Cosmos_PrivateNetworkAccess_Modify.json
|
|
#
|
|
# Features exercised:
|
|
# - Modify effect with requestContext().apiVersion condition on operation
|
|
# - greaterOrEquals on API version string
|
|
# - conflictEffect in details
|
|
|
|
aliases: test_aliases.json
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Configure CosmosDB accounts to disable public network access",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"effect": {
|
|
"type": "String",
|
|
"allowedValues": ["Modify", "Disabled"],
|
|
"defaultValue": "Modify"
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.DocumentDB/databaseAccounts"
|
|
},
|
|
{
|
|
"field": "Microsoft.DocumentDB/databaseAccounts/publicNetworkAccess",
|
|
"notEquals": "Disabled"
|
|
}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]",
|
|
"details": {
|
|
"roleDefinitionIds": [
|
|
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
|
|
"/providers/Microsoft.Authorization/roleDefinitions/5bd9cd88-fe45-4216-938b-f97437e15450"
|
|
],
|
|
"conflictEffect": "audit",
|
|
"operations": [
|
|
{
|
|
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-01-15')]",
|
|
"operation": "addOrReplace",
|
|
"field": "Microsoft.DocumentDB/databaseAccounts/publicNetworkAccess",
|
|
"value": "Disabled"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Public access enabled → modify
|
|
# =========================================================================
|
|
|
|
- note: modify_public_access_enabled
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-public"
|
|
properties:
|
|
publicNetworkAccess: "Enabled"
|
|
api_version: "2023-04-15"
|
|
want_effect: "Modify"
|
|
want_details:
|
|
roleDefinitionIds:
|
|
- "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
|
|
- "/providers/Microsoft.Authorization/roleDefinitions/5bd9cd88-fe45-4216-938b-f97437e15450"
|
|
operations:
|
|
- condition: "[greaterOrEquals(requestContext().apiVersion, '2021-01-15')]"
|
|
operation: "addOrReplace"
|
|
field: "Microsoft.DocumentDB/databaseAccounts/publicNetworkAccess"
|
|
value: "Disabled"
|
|
|
|
- note: modify_public_access_missing
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-no-field"
|
|
properties: {}
|
|
api_version: "2023-04-15"
|
|
want_effect: "Modify"
|
|
|
|
# =========================================================================
|
|
# Public access already disabled → pass
|
|
# =========================================================================
|
|
|
|
- note: pass_public_access_disabled
|
|
resource:
|
|
type: "Microsoft.DocumentDB/databaseAccounts"
|
|
name: "cosmos-disabled"
|
|
properties:
|
|
publicNetworkAccess: "Disabled"
|
|
api_version: "2023-04-15"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Wrong type
|
|
# =========================================================================
|
|
|
|
- note: pass_wrong_type
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "not-cosmos"
|
|
properties:
|
|
publicNetworkAccess: "Enabled"
|
|
api_version: "2023-04-15"
|
|
want_undefined: true
|