regorus/tests/azure_policy/cases/effects.yaml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# Effects Test Suite
# Tests all 9 Azure Policy effect types and parameterized effects.

cases:
  # =========================================================================
  # Simple effects
  # =========================================================================

  - note: effect_deny
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "deny" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "deny"

  - note: effect_audit
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "audit" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "audit"

  - note: effect_disabled
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "disabled" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    # Azure Policy: "disabled" means the policy is inactive — no compliance
    # result is produced.  The compiler correctly returns undefined.
    want_undefined: true

  - note: effect_manual
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "manual" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "manual"

  - note: effect_denyAction
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "denyAction",
          "details": {
            "actionNames": ["delete"]
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "denyAction"

  # =========================================================================
  # Effects with details
  # =========================================================================

  - note: effect_deny_with_message
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "deny",
          "details": {
            "message": "Storage accounts must use HTTPS"
          }
        }
      }
    resource:
      type: "Microsoft.Storage/storageAccounts"
    want_effect: "deny"

  - note: effect_append
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "append",
          "details": [
            {
              "field": "properties.supportsHttpsTrafficOnly",
              "value": true
            }
          ]
        }
      }
    resource:
      type: "Microsoft.Storage/storageAccounts"
    want_effect: "append"

  - note: effect_modify
    policy_rule: |
      {
        "if": {
          "allOf": [
            { "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
            { "field": "tags.environment", "exists": false }
          ]
        },
        "then": {
          "effect": "modify",
          "details": {
            "roleDefinitionIds": [
              "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "operations": [
              {
                "operation": "addOrReplace",
                "field": "tags['environment']",
                "value": "production"
              }
            ]
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
      tags: {}
    want_effect: "modify"

  - note: effect_modify_multiple_operations
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "modify",
          "details": {
            "roleDefinitionIds": [
              "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "operations": [
              {
                "operation": "addOrReplace",
                "field": "tags['environment']",
                "value": "production"
              },
              {
                "operation": "add",
                "field": "tags['managedBy']",
                "value": "policy"
              }
            ]
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "modify"

  - note: effect_auditIfNotExists
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "auditIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "existenceCondition": {
              "allOf": [
                { "field": "properties.publisher", "equals": "Microsoft.Azure.Security" },
                { "field": "properties.type", "equals": "IaaSAntimalware" }
              ]
            }
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - key:
          operation: "lookup_related_resources"
          type: "Microsoft.Compute/virtualMachines/extensions"
        response: null
    want_effect: "auditIfNotExists"

  # Related resource found and existenceCondition matches → compliant (undefined)
  - note: effect_auditIfNotExists_compliant
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "auditIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "existenceCondition": {
              "allOf": [
                { "field": "properties.publisher", "equals": "Microsoft.Azure.Security" },
                { "field": "properties.type", "equals": "IaaSAntimalware" }
              ]
            }
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - response:
          properties:
            publisher: "Microsoft.Azure.Security"
            type: "IaaSAntimalware"
    want_undefined: true

  # Related resource found but existenceCondition fails → non-compliant
  - note: effect_auditIfNotExists_condition_fails
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "auditIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "existenceCondition": {
              "allOf": [
                { "field": "properties.publisher", "equals": "Microsoft.Azure.Security" },
                { "field": "properties.type", "equals": "IaaSAntimalware" }
              ]
            }
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - response:
          properties:
            publisher: "SomeOtherPublisher"
            type: "SomeOtherExtension"
    want_effect: "auditIfNotExists"

  # No existenceCondition — just check if resource exists
  - note: effect_auditIfNotExists_no_condition_exists
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "auditIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions"
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - response:
          name: "some-extension"
          properties: {}
    want_undefined: true

  # No existenceCondition, resource not found → non-compliant
  - note: effect_auditIfNotExists_no_condition_missing
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "auditIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions"
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - response: null
    want_effect: "auditIfNotExists"

  - note: effect_deployIfNotExists
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "deployIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "roleDefinitionIds": [
              "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
            ],
            "existenceCondition": {
              "field": "properties.publisher",
              "equals": "Microsoft.Azure.Monitoring"
            },
            "deployment": {
              "properties": {
                "mode": "incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": []
                }
              }
            }
          }
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    host_await:
      - response: null
    want_effect: "deployIfNotExists"

  # =========================================================================
  # Parameterized effects
  # =========================================================================

  - note: effect_parameterized
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "[parameters('effect')]"
        }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    parameters:
      effect: "deny"
    want_effect: "deny"

  - note: effect_parameterized_with_details
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "[parameters('effect')]",
          "details": {
            "message": "HTTPS required for storage accounts"
          }
        }
      }
    resource:
      type: "Microsoft.Storage/storageAccounts"
    parameters:
      effect: "audit"
    want_effect: "audit"

  # =========================================================================
  # Case-insensitive effect names
  # =========================================================================

  - note: effect_case_insensitive_Deny
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "Deny" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "Deny"

  - note: effect_case_insensitive_AUDIT
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": { "effect": "AUDIT" }
      }
    resource:
      type: "Microsoft.Compute/virtualMachines"
    want_effect: "AUDIT"