mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Anand Krishnamoorthi
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
117 lines
3.7 KiB
YAML
117 lines
3.7 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: Service Bus/AuditDiagnosticLog_Audit
|
|
# Features: AuditIfNotExists with inline existenceCondition evaluation,
|
|
# including count-with-where and ARM template expression padLeft().
|
|
#
|
|
# NOTE: Without an alias catalog, fully-qualified field paths like
|
|
# "Microsoft.Insights/diagnosticSettings/logs[*]..." resolve as raw
|
|
# object keys. The test response structure mirrors this resolution.
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Resource logs in Service Bus should be enabled",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"effect": {
|
|
"type": "string",
|
|
"defaultValue": "AuditIfNotExists",
|
|
"allowedValues": ["AuditIfNotExists", "Disabled"]
|
|
},
|
|
"requiredRetentionDays": {
|
|
"type": "String",
|
|
"defaultValue": "365"
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.ServiceBus/namespaces"
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]",
|
|
"details": {
|
|
"type": "Microsoft.Insights/diagnosticSettings",
|
|
"existenceCondition": {
|
|
"count": {
|
|
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
|
|
"where": {
|
|
"anyOf": [
|
|
{
|
|
"allOf": [
|
|
{
|
|
"field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
|
|
"equals": "true"
|
|
},
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
|
|
"equals": "0"
|
|
},
|
|
{
|
|
"value": "[padLeft(current('Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days'), 3, '0')]",
|
|
"greaterOrEquals": "[padLeft(parameters('requiredRetentionDays'), 3, '0')]"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"greaterOrEquals": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# Related resource not found → non-compliant
|
|
- note: non_compliant_resource_not_found
|
|
resource:
|
|
type: "Microsoft.ServiceBus/namespaces"
|
|
name: "sb-a"
|
|
properties: {}
|
|
host_await:
|
|
- key:
|
|
operation: "lookup_related_resources"
|
|
type: "Microsoft.Insights/diagnosticSettings"
|
|
response: null
|
|
want_effect: "AuditIfNotExists"
|
|
|
|
# Related resource found with compliant diagnostic log → compliant
|
|
- note: compliant_resource_found_and_condition_passes
|
|
resource:
|
|
type: "Microsoft.ServiceBus/namespaces"
|
|
name: "sb-b"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
Microsoft:
|
|
"Insights/diagnosticSettings/logs":
|
|
- retentionPolicy:
|
|
enabled: "true"
|
|
days: "365"
|
|
want_undefined: true
|
|
|
|
# Related resource found but retention too short → non-compliant
|
|
- note: non_compliant_retention_too_short
|
|
resource:
|
|
type: "Microsoft.ServiceBus/namespaces"
|
|
name: "sb-c"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
Microsoft:
|
|
"Insights/diagnosticSettings/logs":
|
|
- retentionPolicy:
|
|
enabled: "true"
|
|
days: "10"
|
|
want_effect: "AuditIfNotExists"
|