mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: SQL/SqlServerAuditing_Audit
|
|
# Features: AuditIfNotExists with inline existenceCondition evaluation.
|
|
# The host returns the related resource (or null if not found), and the
|
|
# compiler evaluates the existenceCondition against it.
|
|
#
|
|
# NOTE: Without an alias catalog, fully-qualified field paths like
|
|
# "Microsoft.Sql/auditingSettings.state" resolve as raw object keys
|
|
# ("Microsoft" → "Sql/auditingSettings" → "state"). The test response
|
|
# structure mirrors this resolution.
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Auditing on SQL server should be enabled",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"effect": {
|
|
"type": "string",
|
|
"defaultValue": "AuditIfNotExists",
|
|
"allowedValues": ["AuditIfNotExists", "Disabled"]
|
|
},
|
|
"setting": {
|
|
"type": "String",
|
|
"defaultValue": "enabled",
|
|
"allowedValues": ["enabled", "disabled"]
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"allOf": [
|
|
{"field": "type", "equals": "Microsoft.Sql/servers"},
|
|
{"field": "kind", "notContains": "analytics"}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]",
|
|
"details": {
|
|
"type": "Microsoft.Sql/servers/auditingSettings",
|
|
"name": "default",
|
|
"existenceCondition": {
|
|
"field": "Microsoft.Sql/auditingSettings.state",
|
|
"equals": "[parameters('setting')]"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# Related resource not found → non-compliant
|
|
- note: non_compliant_resource_not_found
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
kind: "v12.0"
|
|
name: "sql-a"
|
|
properties: {}
|
|
host_await:
|
|
- key:
|
|
operation: "lookup_related_resources"
|
|
type: "Microsoft.Sql/servers/auditingSettings"
|
|
name: "default"
|
|
response: null
|
|
want_effect: "AuditIfNotExists"
|
|
|
|
# Related resource found and existenceCondition matches → compliant
|
|
- note: compliant_resource_found_and_condition_passes
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
kind: "v12.0"
|
|
name: "sql-b"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
Microsoft:
|
|
"Sql/auditingSettings":
|
|
state: "enabled"
|
|
want_undefined: true
|
|
|
|
# Related resource found but existenceCondition fails → non-compliant
|
|
- note: non_compliant_condition_fails
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
kind: "v12.0"
|
|
name: "sql-c"
|
|
properties: {}
|
|
host_await:
|
|
- response:
|
|
Microsoft:
|
|
"Sql/auditingSettings":
|
|
state: "disabled"
|
|
want_effect: "AuditIfNotExists"
|
|
|
|
# Primary resource type doesn't match → if-condition false → compliant
|
|
- note: pass_when_type_not_matching
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "stg"
|
|
properties: {}
|
|
want_undefined: true
|