mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
122 lines
3.8 KiB
YAML
122 lines
3.8 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: PostgreSQL/FlexibleServers_EnablePgAudit_AINE
|
|
# Real Azure Policy: "Auditing with PgAudit should be enabled for PostgreSQL
|
|
# flexible servers"
|
|
# Source: regolator/policyDefinitions/PostgreSQL/FlexibleServers_EnablePgAudit_AINE.json
|
|
#
|
|
# Features exercised:
|
|
# - AuditIfNotExists with simple existenceCondition (notEquals)
|
|
# - Sub-resource type: Microsoft.DBforPostgreSQL/flexibleServers/configurations
|
|
# - host_await for cross-resource lookup
|
|
|
|
aliases: test_aliases.json
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Auditing with PgAudit should be enabled for PostgreSQL flexible servers",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"effect": {
|
|
"type": "string",
|
|
"defaultValue": "AuditIfNotExists",
|
|
"allowedValues": ["AuditIfNotExists", "Disabled"]
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.DBforPostgreSQL/flexibleServers"
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]",
|
|
"details": {
|
|
"type": "Microsoft.DBforPostgreSQL/flexibleServers/configurations",
|
|
"name": "pgaudit.log",
|
|
"existenceCondition": {
|
|
"field": "Microsoft.DBforPostgreSQL/flexibleServers/configurations/value",
|
|
"notEquals": "none"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Related resource not found → AuditIfNotExists
|
|
# =========================================================================
|
|
|
|
- note: aine_config_not_found
|
|
resource:
|
|
type: "Microsoft.DBforPostgreSQL/flexibleServers"
|
|
name: "pg-no-config"
|
|
properties: {}
|
|
host_await:
|
|
- key:
|
|
operation: "lookup_related_resources"
|
|
type: "Microsoft.DBforPostgreSQL/flexibleServers/configurations"
|
|
name: "pgaudit.log"
|
|
response: null
|
|
want_effect: "AuditIfNotExists"
|
|
|
|
# =========================================================================
|
|
# pgaudit.log value is "all" → compliant
|
|
# =========================================================================
|
|
|
|
- note: compliant_pgaudit_enabled
|
|
resource:
|
|
type: "Microsoft.DBforPostgreSQL/flexibleServers"
|
|
name: "pg-audit-on"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
properties:
|
|
value: "all"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# pgaudit.log value is "none" → non-compliant (notEquals "none" fails)
|
|
# =========================================================================
|
|
|
|
- note: aine_pgaudit_none
|
|
resource:
|
|
type: "Microsoft.DBforPostgreSQL/flexibleServers"
|
|
name: "pg-audit-off"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
properties:
|
|
value: "none"
|
|
want_effect: "AuditIfNotExists"
|
|
|
|
# =========================================================================
|
|
# pgaudit.log value has specific categories → compliant
|
|
# =========================================================================
|
|
|
|
- note: compliant_pgaudit_specific
|
|
resource:
|
|
type: "Microsoft.DBforPostgreSQL/flexibleServers"
|
|
name: "pg-audit-specific"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
properties:
|
|
value: "read,write,ddl"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Wrong type → pass
|
|
# =========================================================================
|
|
|
|
- note: pass_wrong_type
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "not-pg"
|
|
properties: {}
|
|
want_undefined: true
|