mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
afdb894d85
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
151 lines
4.3 KiB
YAML
151 lines
4.3 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# E2E Test: Compute/VMSkusAllowed_Deny
|
|
# Real Azure Policy: "Allowed virtual machine size SKUs"
|
|
# Features: allOf, not, field (type + alias), equals, in, parameters()
|
|
|
|
aliases: test_aliases.json
|
|
|
|
policy_definition: |
|
|
{
|
|
"properties": {
|
|
"displayName": "Allowed virtual machine size SKUs",
|
|
"policyType": "BuiltIn",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"listOfAllowedSKUs": {
|
|
"type": "Array",
|
|
"metadata": {
|
|
"displayName": "Allowed Size SKUs"
|
|
}
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
{
|
|
"not": {
|
|
"field": "Microsoft.Compute/virtualMachines/sku.name",
|
|
"in": "[parameters('listOfAllowedSKUs')]"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "Deny"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Deny — VM SKU not in allowed list
|
|
# =========================================================================
|
|
|
|
- note: deny_disallowed_sku
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_E64i_v3"
|
|
parameters:
|
|
listOfAllowedSKUs:
|
|
- "Standard_D2s_v3"
|
|
- "Standard_D4s_v3"
|
|
- "Standard_D8s_v3"
|
|
want_effect: "Deny"
|
|
|
|
# =========================================================================
|
|
# No effect — VM SKU is in allowed list
|
|
# =========================================================================
|
|
|
|
- note: allow_permitted_sku
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_D4s_v3"
|
|
parameters:
|
|
listOfAllowedSKUs:
|
|
- "Standard_D2s_v3"
|
|
- "Standard_D4s_v3"
|
|
- "Standard_D8s_v3"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# No effect — wrong resource type (not a VM)
|
|
# =========================================================================
|
|
|
|
- note: skip_wrong_resource_type
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "myStorage"
|
|
location: "eastus"
|
|
properties: {}
|
|
parameters:
|
|
listOfAllowedSKUs:
|
|
- "Standard_D2s_v3"
|
|
want_undefined: true
|
|
|
|
# =========================================================================
|
|
# Deny — single allowed SKU, VM doesn't match
|
|
# =========================================================================
|
|
|
|
- note: deny_single_allowed_sku
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "bigVM"
|
|
location: "westus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_M128s"
|
|
parameters:
|
|
listOfAllowedSKUs:
|
|
- "Standard_B1s"
|
|
want_effect: "Deny"
|
|
|
|
# =========================================================================
|
|
# No effect — empty allowed list means everything blocked? No: `in` with
|
|
# empty array is always false → not(false)=true → Deny.
|
|
# =========================================================================
|
|
|
|
- note: deny_empty_allowed_list
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "anyVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_D2s_v3"
|
|
parameters:
|
|
listOfAllowedSKUs: []
|
|
want_effect: "Deny"
|
|
|
|
# =========================================================================
|
|
# Case sensitivity — SKU names are compared case-insensitively by the
|
|
# `in` operator (Azure Policy string comparison semantics)
|
|
# =========================================================================
|
|
|
|
- note: allow_case_insensitive_sku
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "standard_d4s_v3"
|
|
parameters:
|
|
listOfAllowedSKUs:
|
|
- "Standard_D4s_v3"
|
|
want_undefined: true
|