diff --git a/.github/workflows/ms.authorization.policysetdefinitions.yml b/.github/workflows/ms.authorization.policysetdefinitions.yml index d1bd00c8d4..0e40d0496a 100644 --- a/.github/workflows/ms.authorization.policysetdefinitions.yml +++ b/.github/workflows/ms.authorization.policysetdefinitions.yml @@ -109,8 +109,7 @@ jobs: - name: 'Using test file [${{ matrix.moduleTestFilePaths }}]' uses: ./.github/actions/templates/validateModuleDeployment with: - templateFilePath: '${{ env.modulePath }}/deploy.bicep' - parameterFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' + templateFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' location: '${{ env.location }}' resourceGroupName: '${{ env.resourceGroupName }}' subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}' diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.common/deploy.test.bicep b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.common/deploy.test.bicep new file mode 100644 index 0000000000..738f4beaf6 --- /dev/null +++ b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.common/deploy.test.bicep @@ -0,0 +1,64 @@ +targetScope = 'managementGroup' + +// ========== // +// Parameters // +// ========== // +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apsdmgcom' + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../managementGroup/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyDefinitions: [ + { + groupNames: [ + 'ARM' + ] + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' + policyDefinitionReferenceId: 'Allowed locations_1' + } + { + groupNames: [ + 'ARM' + ] + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988' + policyDefinitionReferenceId: 'Allowed locations for resource groups_1' + } + ] + // Non-required parameters + description: '[Description] This policy set definition is deployed at management group scope' + displayName: '[DisplayName] This policy set definition is deployed at management group scope' + managementGroupId: last(split(managementGroup().id, '/')) + metadata: { + category: 'Security' + version: '1' + } + policyDefinitionGroups: [ + { + name: 'Network' + } + { + name: 'ARM' + } + ] + } +} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min.parameters.json b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min.parameters.json deleted file mode 100644 index 92f9d4ac2f..0000000000 --- a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min.parameters.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-mg-min-policySet" - }, - "policyDefinitions": { - "value": [ - { - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" - } - ] - } - } -} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min/deploy.test.bicep b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min/deploy.test.bicep new file mode 100644 index 0000000000..4847af6d7f --- /dev/null +++ b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.min/deploy.test.bicep @@ -0,0 +1,30 @@ +targetScope = 'managementGroup' + +// ========== // +// Parameters // +// ========== // +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apsdmgmin' + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../managementGroup/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyDefinitions: [ + { + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' + } + ] + } +} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.parameters.json b/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.parameters.json deleted file mode 100644 index 029e2d47c8..0000000000 --- a/modules/Microsoft.Authorization/policySetDefinitions/.test/mg.parameters.json +++ /dev/null @@ -1,66 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-mg-policySet" - }, - "displayName": { - "value": "[DisplayName] This policy set definition is deployed at management group scope" - }, - "description": { - "value": "[Description] This policy set definition is deployed at management group scope" - }, - "policyDefinitionGroups": { - "value": [ - { - "name": "Network" - }, - { - "name": "ARM" - } - ] - }, - "policyDefinitions": { - "value": [ - { - "groupNames": [ - "ARM" - ], - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c", - "policyDefinitionReferenceId": "Allowed locations_1" - }, - { - "groupNames": [ - "ARM" - ], - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988", - "policyDefinitionReferenceId": "Allowed locations for resource groups_1" - } - ] - }, - "metadata": { - "value": { - "category": "Security", - "version": "1" - } - }, - "managementGroupId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.common/deploy.test.bicep b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.common/deploy.test.bicep new file mode 100644 index 0000000000..905b49dcfa --- /dev/null +++ b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.common/deploy.test.bicep @@ -0,0 +1,64 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apsdsubcom' + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../subscription/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyDefinitions: [ + { + groupNames: [ + 'ARM' + ] + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' + policyDefinitionReferenceId: 'Allowed locations_1' + } + { + groupNames: [ + 'ARM' + ] + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988' + policyDefinitionReferenceId: 'Allowed locations for resource groups_1' + } + ] + // Non-required parameters + description: '[Description] This policy set definition is deployed at subscription scope' + displayName: '[DisplayName] This policy set definition is deployed at subscription scope' + metadata: { + category: 'Security' + version: '1' + } + policyDefinitionGroups: [ + { + name: 'Network' + } + { + name: 'ARM' + } + ] + subscriptionId: subscription().subscriptionId + } +} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min.parameters.json b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min.parameters.json deleted file mode 100644 index f6a7e68f64..0000000000 --- a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min.parameters.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-sub-min-policySet" - }, - "policyDefinitions": { - "value": [ - { - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" - } - ] - }, - "subscriptionId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min/deploy.test.bicep b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min/deploy.test.bicep new file mode 100644 index 0000000000..514f7b8b93 --- /dev/null +++ b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.min/deploy.test.bicep @@ -0,0 +1,32 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apsdsubmin' + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../subscription/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyDefinitions: [ + { + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' + } + ] + // Non-required parameters + subscriptionId: '<>' + } +} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.parameters.json b/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.parameters.json deleted file mode 100644 index 16a92428b1..0000000000 --- a/modules/Microsoft.Authorization/policySetDefinitions/.test/sub.parameters.json +++ /dev/null @@ -1,66 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-sub-policySet" - }, - "displayName": { - "value": "[DisplayName] This policy set definition is deployed at subscription scope" - }, - "description": { - "value": "[Description] This policy set definition is deployed at subscription scope" - }, - "policyDefinitionGroups": { - "value": [ - { - "name": "Network" - }, - { - "name": "ARM" - } - ] - }, - "policyDefinitions": { - "value": [ - { - "groupNames": [ - "ARM" - ], - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c", - "policyDefinitionReferenceId": "Allowed locations_1" - }, - { - "groupNames": [ - "ARM" - ], - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988", - "policyDefinitionReferenceId": "Allowed locations for resource groups_1" - } - ] - }, - "metadata": { - "value": { - "category": "Security", - "version": "1" - } - }, - "subscriptionId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policySetDefinitions/readme.md b/modules/Microsoft.Authorization/policySetDefinitions/readme.md index 1afe6bbac9..9f636f9cc8 100644 --- a/modules/Microsoft.Authorization/policySetDefinitions/readme.md +++ b/modules/Microsoft.Authorization/policySetDefinitions/readme.md @@ -142,7 +142,7 @@ The following module usage examples are retrieved from the content of the files >**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order. -

Example 1: Mg Min

+

Example 1: Mg.Common

@@ -150,75 +150,10 @@ The following module usage examples are retrieved from the content of the files ```bicep module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicySetDefinitions' + name: '${uniqueString(deployment().name)}-test-apsdmgcom' params: { // Required parameters - name: '<>-mg-min-policySet' - policyDefinitions: [ - { - parameters: { - listOfAllowedLocations: { - value: [ - 'australiaeast' - ] - } - } - policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' - } - ] - } -} -``` - -
-

- -

- -via JSON Parameter file - -```json -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - // Required parameters - "name": { - "value": "<>-mg-min-policySet" - }, - "policyDefinitions": { - "value": [ - { - "parameters": { - "listOfAllowedLocations": { - "value": [ - "australiaeast" - ] - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" - } - ] - } - } -} -``` - -
-

- -

Example 2: Mg

- -
- -via Bicep module - -```bicep -module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicySetDefinitions' - params: { - // Required parameters - name: '<>-mg-policySet' + name: '<>apsdmgcom001' policyDefinitions: [ { groupNames: [ @@ -252,7 +187,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl // Non-required parameters description: '[Description] This policy set definition is deployed at management group scope' displayName: '[DisplayName] This policy set definition is deployed at management group scope' - managementGroupId: '<>' + managementGroupId: '' metadata: { category: 'Security' version: '1' @@ -283,7 +218,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl "parameters": { // Required parameters "name": { - "value": "<>-mg-policySet" + "value": "<>apsdmgcom001" }, "policyDefinitions": { "value": [ @@ -325,7 +260,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl "value": "[DisplayName] This policy set definition is deployed at management group scope" }, "managementGroupId": { - "value": "<>" + "value": "" }, "metadata": { "value": { @@ -350,7 +285,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl

-

Example 3: Sub Min

+

Example 2: Mg.Min

@@ -358,10 +293,10 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl ```bicep module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicySetDefinitions' + name: '${uniqueString(deployment().name)}-test-apsdmgmin' params: { // Required parameters - name: '<>-sub-min-policySet' + name: '<>apsdmgmin001' policyDefinitions: [ { parameters: { @@ -374,8 +309,6 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' } ] - // Non-required parameters - subscriptionId: '<>' } } ``` @@ -394,7 +327,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl "parameters": { // Required parameters "name": { - "value": "<>-sub-min-policySet" + "value": "<>apsdmgmin001" }, "policyDefinitions": { "value": [ @@ -409,10 +342,6 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" } ] - }, - // Non-required parameters - "subscriptionId": { - "value": "<>" } } } @@ -421,7 +350,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl

-

Example 4: Sub

+

Example 3: Sub.Common

@@ -429,10 +358,10 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl ```bicep module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicySetDefinitions' + name: '${uniqueString(deployment().name)}-test-apsdsubcom' params: { // Required parameters - name: '<>-sub-policySet' + name: '<>apsdsubcom001' policyDefinitions: [ { groupNames: [ @@ -478,7 +407,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl name: 'ARM' } ] - subscriptionId: '<>' + subscriptionId: '' } } ``` @@ -497,7 +426,7 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl "parameters": { // Required parameters "name": { - "value": "<>-sub-policySet" + "value": "<>apsdsubcom001" }, "policyDefinitions": { "value": [ @@ -554,6 +483,77 @@ module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/depl } ] }, + "subscriptionId": { + "value": "" + } + } +} +``` + +
+

+ +

Example 4: Sub.Min

+ +
+ +via Bicep module + +```bicep +module policySetDefinitions './Microsoft.Authorization/policySetDefinitions/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-apsdsubmin' + params: { + // Required parameters + name: '<>apsdsubmin001' + policyDefinitions: [ + { + parameters: { + listOfAllowedLocations: { + value: [ + 'australiaeast' + ] + } + } + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c' + } + ] + // Non-required parameters + subscriptionId: '<>' + } +} +``` + +
+

+ +

+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + // Required parameters + "name": { + "value": "<>apsdsubmin001" + }, + "policyDefinitions": { + "value": [ + { + "parameters": { + "listOfAllowedLocations": { + "value": [ + "australiaeast" + ] + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" + } + ] + }, + // Non-required parameters "subscriptionId": { "value": "<>" }