Skip to content

Commit a57aff5

Browse files
rberlindrberlind
authored
Merge pull request hashicorp#297 from hashicorp/add-azure-sec-center-pricing-policy
add require-free-sec-center-subscription-pricing-for-vms.sentinel
2 parents 7636d16 + 2740423 commit a57aff5

File tree

5 files changed

+221
-0
lines changed

5 files changed

+221
-0
lines changed

‎governance/third-generation/azure/require-free-sec-center-subscription-pricing-for-vms.sentinel

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# This policy uses the Sentinel tfplan/v2 import to require that
2+
# any occurence of the azurerm_security_center_subscription_pricing
3+
# resource that lists VirtualMachines as the resource_type also lists
4+
# the tier as "Free"
5+
6+
# Import common-functions/tfplan-functions/tfplan-functions.sentinel with
7+
# alias "plan"
8+
import "tfplan-functions" as plan
9+
10+
# Get all Azure Security Center Pricings
11+
allAzureSecCenterSubPricings = plan.find_resources("azurerm_security_center_subscription_pricing")
12+
13+
# Filter to Azure Security Center Pricings for Virtual Machines
14+
# Warnings will not be printed for violations since the last parameter is false
15+
azureSecCenterSubPricingsForVMs = plan.filter_attribute_is_value(
16+
allAzureSecCenterSubPricings,
17+
"resource_type", "VirtualMachines", false)
18+
19+
# Filter to Azure Security Center Pricings for Virtual Machines with pricing
20+
# tier set to Standard.
21+
# When applying a second filter, we restrict to the resources map returned from
22+
# the first filter.
23+
# Warnings will be printed for all violations since the last parameter is true
24+
violatingAzureSecCenterSubPricingsForVMs = plan.filter_attribute_is_value(
25+
azureSecCenterSubPricingsForVMs["resources"],
26+
"tier", "Standard", true)
27+
28+
# Main rule
29+
main = rule {
30+
length(violatingAzureSecCenterSubPricingsForVMs["messages"]) is 0
31+
}

‎governance/third-generation/azure/test/require-free-sec-center-subscription-pricing-for-vms/fail.hcl

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
module "tfplan-functions" {
2+
source = "../../../common-functions/tfplan-functions/tfplan-functions.sentinel"
3+
}
4+
5+
mock "tfplan/v2" {
6+
module {
7+
source = "mock-tfplan-fail.sentinel"
8+
}
9+
}
10+
11+
test {
12+
rules = {
13+
main = false
14+
}
15+
}

‎governance/third-generation/azure/test/require-free-sec-center-subscription-pricing-for-vms/mock-tfplan-fail.sentinel

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
terraform_version = "1.0.5"
2+
3+
variables = {}
4+
5+
resource_changes = {
6+
"azurerm_security_center_subscription_pricing.keyvaults": {
7+
"address": "azurerm_security_center_subscription_pricing.keyvaults",
8+
"change": {
9+
"actions": [
10+
"create",
11+
],
12+
"after": {
13+
"resource_type": "KeyVaults",
14+
"tier": "Standard",
15+
"timeouts": null,
16+
},
17+
"after_unknown": {
18+
"id": true,
19+
},
20+
"before": null,
21+
},
22+
"deposed": "",
23+
"index": null,
24+
"mode": "managed",
25+
"module_address": "",
26+
"name": "keyvaults",
27+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
28+
"type": "azurerm_security_center_subscription_pricing",
29+
},
30+
"azurerm_security_center_subscription_pricing.storageaccounts": {
31+
"address": "azurerm_security_center_subscription_pricing.storageaccounts",
32+
"change": {
33+
"actions": [
34+
"create",
35+
],
36+
"after": {
37+
"resource_type": "StorageAccounts",
38+
"tier": "Free",
39+
"timeouts": null,
40+
},
41+
"after_unknown": {
42+
"id": true,
43+
},
44+
"before": null,
45+
},
46+
"deposed": "",
47+
"index": null,
48+
"mode": "managed",
49+
"module_address": "",
50+
"name": "storageaccounts",
51+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
52+
"type": "azurerm_security_center_subscription_pricing",
53+
},
54+
"azurerm_security_center_subscription_pricing.vms": {
55+
"address": "azurerm_security_center_subscription_pricing.vms",
56+
"change": {
57+
"actions": [
58+
"create",
59+
],
60+
"after": {
61+
"resource_type": "VirtualMachines",
62+
"tier": "Standard",
63+
"timeouts": null,
64+
},
65+
"after_unknown": {
66+
"id": true,
67+
},
68+
"before": null,
69+
},
70+
"deposed": "",
71+
"index": null,
72+
"mode": "managed",
73+
"module_address": "",
74+
"name": "vms",
75+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
76+
"type": "azurerm_security_center_subscription_pricing",
77+
},
78+
}
79+
80+
output_changes = {}

‎governance/third-generation/azure/test/require-free-sec-center-subscription-pricing-for-vms/mock-tfplan-pass.sentinel

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
terraform_version = "1.0.5"
2+
3+
variables = {}
4+
5+
resource_changes = {
6+
"azurerm_security_center_subscription_pricing.keyvaults": {
7+
"address": "azurerm_security_center_subscription_pricing.keyvaults",
8+
"change": {
9+
"actions": [
10+
"create",
11+
],
12+
"after": {
13+
"resource_type": "KeyVaults",
14+
"tier": "Standard",
15+
"timeouts": null,
16+
},
17+
"after_unknown": {
18+
"id": true,
19+
},
20+
"before": null,
21+
},
22+
"deposed": "",
23+
"index": null,
24+
"mode": "managed",
25+
"module_address": "",
26+
"name": "keyvaults",
27+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
28+
"type": "azurerm_security_center_subscription_pricing",
29+
},
30+
"azurerm_security_center_subscription_pricing.storageaccounts": {
31+
"address": "azurerm_security_center_subscription_pricing.storageaccounts",
32+
"change": {
33+
"actions": [
34+
"create",
35+
],
36+
"after": {
37+
"resource_type": "StorageAccounts",
38+
"tier": "Free",
39+
"timeouts": null,
40+
},
41+
"after_unknown": {
42+
"id": true,
43+
},
44+
"before": null,
45+
},
46+
"deposed": "",
47+
"index": null,
48+
"mode": "managed",
49+
"module_address": "",
50+
"name": "storageaccounts",
51+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
52+
"type": "azurerm_security_center_subscription_pricing",
53+
},
54+
"azurerm_security_center_subscription_pricing.vms": {
55+
"address": "azurerm_security_center_subscription_pricing.vms",
56+
"change": {
57+
"actions": [
58+
"create",
59+
],
60+
"after": {
61+
"resource_type": "VirtualMachines",
62+
"tier": "Free",
63+
"timeouts": null,
64+
},
65+
"after_unknown": {
66+
"id": true,
67+
},
68+
"before": null,
69+
},
70+
"deposed": "",
71+
"index": null,
72+
"mode": "managed",
73+
"module_address": "",
74+
"name": "vms",
75+
"provider_name": "registry.terraform.io/hashicorp/azurerm",
76+
"type": "azurerm_security_center_subscription_pricing",
77+
},
78+
}
79+
80+
output_changes = {}

‎governance/third-generation/azure/test/require-free-sec-center-subscription-pricing-for-vms/pass.hcl

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
module "tfplan-functions" {
2+
source = "../../../common-functions/tfplan-functions/tfplan-functions.sentinel"
3+
}
4+
5+
mock "tfplan/v2" {
6+
module {
7+
source = "mock-tfplan-pass.sentinel"
8+
}
9+
}
10+
11+
test {
12+
rules = {
13+
main = true
14+
}
15+
}

0 commit comments

Comments
 (0)