Skip to content

Commit 939205c

Browse files
samarthlakhotiasamarthlakhotia
authored
[Policy Insights] Added cmdlets for policy attestations (#20696)
* Added cmdlets for policy attestations * Addressed pipeline errors * Addressed PR comments * Subscription ID Changed * PR Comments 2 * Metadata Tests * PR Comments Updated Docs
1 parent 64c1955 commit 939205c

35 files changed

+9664
-10
lines changed

‎src/PolicyInsights/PolicyInsights.Test/EnvSetup/AttestationMetadata.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"TestKey": "TestValue"}

‎src/PolicyInsights/PolicyInsights.Test/EnvSetup/EnvironmentSetup.ps1

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,74 @@ Start-TestSleep -Seconds 60
9191
foreach ($resourceGroupName in @($resourceGroup1, $resourceGroup2)) {
9292
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateFile "$PSScriptRoot/CreateNSGsTemplate.json" -resourceCount 510 -resourceNamePrefix $(Get-TestResourceNamePrefix)
9393
}
94+
95+
#region Attestation Tests Setup
96+
$resourceGroup3 = $(Get-PSAttestationTestRGName)
97+
98+
# Create the required RG(s) for attestations.
99+
foreach ($resourceGroupName in @($resourceGroup3)) {
100+
Get-AzResourceGroup -Name $resourceGroupName -ErrorVariable rgNotPresent -ErrorAction SilentlyContinue
101+
if ($rgNotPresent) {
102+
New-AzResourceGroup -Name $resourceGroupName -Location "northcentralus"
103+
}
104+
}
105+
106+
# Create Subscription targetting manual policy
107+
$manualPolicySubcriptionDefinition = New-AzPolicyDefinition -Name $(Get-TestManualPolicyDefinitonNameSub) -Policy "$PSScriptRoot/ManualPolicySubDefinition.json" -DisplayName "PS cmdlet tests: Subscription Manual Policy" -Mode All
108+
109+
# Create RG targetting manual policy
110+
$manualPolicyRGDefinition = New-AzPolicyDefinition -Name $(Get-TestManualPolicyDefinitonNameRG) -Policy "$PSScriptRoot/ManualPolicyRGDefinition.json" -DisplayName "PS cmdlet tests: RG Manual Policy" -Mode All
111+
112+
# Create Resource targetting manual policy
113+
$manualPolicyResourceDefinition = New-AzPolicyDefinition -Name $(Get-TestManualPolicyDefinitonNameResource) -Policy "$PSScriptRoot/ManualPolicyResourceDefinition.json" -DisplayName "PS cmdlet tests: Resource Manual Policy" -Mode All
114+
115+
# Create a network security group for testing resource level attestations.
116+
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroup3 -TemplateFile "$PSScriptRoot/CreateNSGsTemplate.json" -resourceCount 1 -resourceNamePrefix $(Get-TestResourceNamePrefix)
117+
118+
# Assign the manual policies targetting each of Subscription, Resource Groups and Resource Types to the subscription
119+
$manualPolicySubAssignment = New-AzPolicyAssignment -Name $(Get-TestAttestationSubscriptionPolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: Subscription Manual Policy" -PolicyDefinition $manualPolicySubcriptionDefinition
120+
121+
$manualPolicyRGAssignment = New-AzPolicyAssignment -Name $(Get-TestAttestationRGPolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: RG Manual Policy" -PolicyDefinition $manualPolicyRGDefinition
122+
123+
$manualPolicyResourceAssignment = New-AzPolicyAssignment -Name $(Get-TestAttestationResourcePolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: Resource Manual Policy" -PolicyDefinition $manualPolicyResourceDefinition
124+
125+
# Define Policy Initiatives
126+
$manualpolicyDefinitionsSubscription = @"
127+
[
128+
{
129+
"policyDefinitionId":"$($manualPolicySubcriptionDefinition.ResourceId)",
130+
"policyDefinitionReferenceId": "$(Get-TestManualPolicyDefinitonNameSub)_1"
131+
}
132+
]
133+
"@
134+
135+
$manualpolicyDefinitionsRG = @"
136+
[
137+
{
138+
"policyDefinitionId":"$($manualPolicyRGDefinition.ResourceId)",
139+
"policyDefinitionReferenceId": "$(Get-TestManualPolicyDefinitonNameRG)_1"
140+
}
141+
]
142+
"@
143+
144+
$manualpolicyDefinitionsResource = @"
145+
[
146+
{
147+
"policyDefinitionId":"$($manualPolicyResourceDefinition.ResourceId)",
148+
"policyDefinitionReferenceId": "$(Get-TestManualPolicyDefinitonNameResource)_1"
149+
}
150+
]
151+
"@
152+
153+
$policySetDefinitionSub = New-AzPolicySetDefinition -Name $(Get-TestManualPolicyInitiativeNameSub) -DisplayName "PS cmdlet tests: Attestation initiative SUB" -PolicyDefinition $manualpolicyDefinitionsSubscription -SubscriptionId $subscriptionId
154+
$policySetDefinitionRG = New-AzPolicySetDefinition -Name $(Get-TestManualPolicyInitiativeNameRG) -DisplayName "PS cmdlet tests: Attestation initiative RG" -PolicyDefinition $manualpolicyDefinitionsRG -SubscriptionId $subscriptionId
155+
$policySetDefinitionResource = New-AzPolicySetDefinition -Name $(Get-TestManualPolicyInitiativeNameResource) -DisplayName "PS cmdlet tests: Attestation initiative Resource" -PolicyDefinition $manualpolicyDefinitionsResource -SubscriptionId $subscriptionId
156+
157+
# Assign the initiatives to the subscription
158+
New-AzPolicyAssignment -Name $(Get-TestInitiativeAttestationSubPolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: Attestation initiative SUB" -PolicySetDefinition $policySetDefinitionSub
159+
160+
New-AzPolicyAssignment -Name $(Get-TestInitiativeAttestationRGPolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: Attestation initiative RG" -PolicySetDefinition $policySetDefinitionRG
161+
162+
New-AzPolicyAssignment -Name $(Get-TestAttestationInitiativeResourcePolicyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: Attestation initiative Resource" -PolicySetDefinition $policySetDefinitionResource
163+
164+
#endregion

‎src/PolicyInsights/PolicyInsights.Test/EnvSetup/ManualPolicyRGDefinition.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"if": {
3+
"field": "type",
4+
"equals": "microsoft.resources/subscriptions/resourcegroups"
5+
},
6+
"then": {
7+
"effect": "manual"
8+
}
9+
}

‎src/PolicyInsights/PolicyInsights.Test/EnvSetup/ManualPolicyResourceDefinition.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"if": {
3+
"field": "type",
4+
"equals": "Microsoft.Network/networkSecurityGroups"
5+
},
6+
"then": {
7+
"effect": "manual"
8+
}
9+
}

‎src/PolicyInsights/PolicyInsights.Test/EnvSetup/ManualPolicySubDefinition.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"if": {
3+
"field": "type",
4+
"equals": "microsoft.resources/subscriptions"
5+
},
6+
"then": {
7+
"effect": "manual"
8+
}
9+
}

‎src/PolicyInsights/PolicyInsights.Test/PolicyInsights.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
</PropertyGroup>
1212

1313
<ItemGroup>
14-
<PackageReference Include="Microsoft.Azure.Management.PolicyInsights" Version="5.0.0" />
14+
<PackageReference Include="Microsoft.Azure.Management.PolicyInsights" Version="5.1.0" />
1515
</ItemGroup>
1616

1717
</Project>

‎src/PolicyInsights/PolicyInsights.Test/ScenarioTests/AttestationTests.cs

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
16+
using System;
17+
using System.Collections.Generic;
18+
using System.Text;
19+
using Xunit;
20+
using Xunit.Abstractions;
21+
22+
namespace Microsoft.Azure.Commands.PolicyInsights.Test.ScenarioTests
23+
{
24+
public class AttestationTests : PolicyInsightsTestRunner
25+
26+
{
27+
public AttestationTests(Xunit.Abstractions.ITestOutputHelper output) : base(output)
28+
{
29+
}
30+
31+
[Fact]
32+
[Trait(Category.AcceptanceType, Category.CheckIn)]
33+
public void SubscriptionScopeCrud()
34+
{
35+
TestRunner.RunTestScript("Attestation-SubscriptionScope-Crud");
36+
}
37+
38+
[Fact]
39+
[Trait(Category.AcceptanceType, Category.CheckIn)]
40+
public void ResourceGroupScopeCrud()
41+
{
42+
TestRunner.RunTestScript("Attestation-ResourceGroupScope-Crud");
43+
}
44+
45+
46+
[Fact]
47+
[Trait(Category.AcceptanceType, Category.CheckIn)]
48+
public void ResourceScopeCrud()
49+
{
50+
TestRunner.RunTestScript("Attestation-ResourceScope-Crud");
51+
}
52+
53+
[Fact]
54+
[Trait(Category.AcceptanceType, Category.CheckIn)]
55+
public void AttestationGetCollection()
56+
{
57+
TestRunner.RunTestScript("Attestation-GetCollection");
58+
}
59+
60+
[Fact]
61+
[Trait(Category.AcceptanceType, Category.CheckIn)]
62+
public void AttestationErrorHandling()
63+
{
64+
TestRunner.RunTestScript("Attestation-Error-Handling");
65+
}
66+
67+
}
68+
}

0 commit comments

Comments
 (0)