Skip to content

Commit

Permalink
move creation of resource group to utils.ps1
Browse files Browse the repository at this point in the history
  • Loading branch information
VeryEarly committed Apr 1, 2024
1 parent 656a440 commit f43da67
Show file tree
Hide file tree
Showing 17 changed files with 215 additions and 247 deletions.
Original file line number Diff line number Diff line change
@@ -1,17 +1,16 @@
# setup the Pester environment for policy backcompat tests
. (Join-Path $PSScriptRoot 'Common.ps1') 'Backcompat-NewPolicyExemptionParameters'

Describe 'Backcompat-NewPolicyExemptionParameters' -Tag 'LiveOnly' {
Describe 'Backcompat-NewPolicyExemptionParameters' {

BeforeAll {
# make a new resource group and policy assignment of some built-in definition
$rgname = Get-ResourceGroupName
$rgname = $env.rgname
$goodScope = "/subscriptions/$subscriptionId/resourceGroups/$rgname"

$rg = New-ResourceGroup -Name $rgname -Location "west us"
$assignmentName = 'testPA1'
$policy = Get-AzPolicyDefinition -Builtin | ?{ $_.Name -eq '0a914e76-4921-4c19-b460-a2d36003525a' }
$goodPolicyAssignment = New-AzPolicyAssignment -Name $assignmentName -Scope $rg.ResourceId -PolicyDefinition $policy -Description $description -BackwardCompatible
$goodPolicyAssignment = New-AzPolicyAssignment -Name $assignmentName -Scope $env.scope -PolicyDefinition $policy -Description $description -BackwardCompatible
}

It 'no parameters' {
Expand Down Expand Up @@ -46,7 +45,6 @@ Describe 'Backcompat-NewPolicyExemptionParameters' -Tag 'LiveOnly' {
AfterAll {
$remove = Remove-AzPolicyAssignment -Name $assignmentName -BackwardCompatible

$remove = (Remove-ResourceGroup -Name $rgname) -and $remove
Assert-AreEqual True $remove

Write-Host -ForegroundColor Magenta "Cleanup complete."
Expand Down
Original file line number Diff line number Diff line change
@@ -1,19 +1,18 @@
# setup the Pester environment for policy backcompat tests
. (Join-Path $PSScriptRoot 'Common.ps1') 'Backcompat-PolicyAssignmentCRUD'

Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
Describe 'Backcompat-PolicyAssignmentCRUD' {

BeforeAll {
# setup
$rgname = Get-ResourceGroupName
$rgname = $env.rgname
$policyName = Get-ResourceName

$policySetDefName = Get-ResourceName
$policyDefName1 = Get-ResourceName
$policyDefName2 = Get-ResourceName

# make a new resource group and policy definition
$rg = New-ResourceGroup -Name $rgname -Location "west us"
$policyDefinition1 = New-AzPolicyDefinition -Name $policyDefName1 -Policy "$testFilesFolder\SamplePolicyDefinition.json" -Description $description -BackwardCompatible
$policyDefinition2 = New-AzPolicyDefinition -Name $policyDefName2 -Policy "$testFilesFolder\SamplePolicyDefinition.json" -Description $description -BackwardCompatible
$policySetString = "[{""policyDefinitionId"":""" + $policyDefinition1.PolicyDefinitionId + """}, {""policyDefinitionId"":""" + $policyDefinition2.PolicyDefinitionId + """}]"
Expand All @@ -29,13 +28,13 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'make a policy assignment at RG scope' {
{
# assign the policy definition to the resource group, get the assignment back and validate
$actual = New-AzPolicyAssignment -Name $test1 -PolicySetDefinition $policySet -Scope $rg.ResourceId -Description $description -NonComplianceMessage $nonComplianceMessages -BackwardCompatible
$expected = Get-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$actual = New-AzPolicyAssignment -Name $test1 -PolicySetDefinition $policySet -Scope $env.scope -Description $description -NonComplianceMessage $nonComplianceMessages -BackwardCompatible
$expected = Get-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible
Assert-AreEqual $expected.Name $actual.Name
Assert-AreEqual Microsoft.Authorization/policyAssignments $actual.ResourceType
Assert-AreEqual $expected.PolicyAssignmentId $actual.PolicyAssignmentId
Assert-AreEqual $expected.Properties.PolicyDefinitionId $policySet.ResourceId
Assert-AreEqual $expected.Properties.Scope $rg.ResourceId
Assert-AreEqual $expected.Properties.Scope $env.scope
Assert-AreEqual 1 $expected.Properties.NonComplianceMessages.Length
Assert-AreEqual "General message" $expected.Properties.NonComplianceMessages[0].Message
} | Should -Not -Throw
Expand All @@ -44,7 +43,7 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'get policy assignment by Id' {
{
# get first assignment back by name
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible

# get it again by id and validate
$actualId = Get-AzPolicyAssignment -Id $actual.ResourceId -BackwardCompatible
Expand All @@ -57,7 +56,7 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'make a policy assignment with multiple noncompliance messages' {
{
# get first assignment back by name
$get = Get-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$get = Get-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible

$nonComplianceMessages = $nonComplianceMessages + @(@{
Message = "Specific message 1"
Expand All @@ -68,7 +67,7 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
Assert-AreEqual 2 $nonComplianceMessages.Length

# create it again with two non-compliance messages
$new = New-AzPolicyAssignment -Name $test1 -PolicySetDefinition $policySet -Scope $rg.ResourceId -Description $description -NonComplianceMessage $nonComplianceMessages -BackwardCompatible
$new = New-AzPolicyAssignment -Name $test1 -PolicySetDefinition $policySet -Scope $env.scope -Description $description -NonComplianceMessage $nonComplianceMessages -BackwardCompatible
Assert-AreEqual $get.ResourceId $new.ResourceId

# get it again by id and validate non-compliance messages
Expand Down Expand Up @@ -96,7 +95,7 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'update policy assignment to a single noncompliance message' {
{
# get first assignment back again
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible

$nonComplianceMessages = @(@{ Message = "General non-compliance message" })

Expand All @@ -111,7 +110,7 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'update policy assignment back to a multiple noncompliance message' {
{
# get first assignment back again
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$actual = Get-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible

$nonComplianceMessages = @(
@{
Expand All @@ -135,8 +134,8 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {
It 'list policy assignments' {
{
# make another policy assignment, ensure both are present in resource group scope listing
$expected = New-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -PolicyDefinition $policyDefinition1 -Description $description -BackwardCompatible
$list1 = Get-AzPolicyAssignment -Scope $rg.ResourceId -BackwardCompatible | ?{ $_.Name -in @($test1, $test2) }
$expected = New-AzPolicyAssignment -Name $test2 -Scope $env.scope -PolicyDefinition $policyDefinition1 -Description $description -BackwardCompatible
$list1 = Get-AzPolicyAssignment -Scope $env.scope -BackwardCompatible | ?{ $_.Name -in @($test1, $test2) }
Assert-AreEqual 2 $list1.Count

# ensure both are present in full listing
Expand All @@ -151,12 +150,11 @@ Describe 'Backcompat-PolicyAssignmentCRUD' -Tag 'LiveOnly' {

AfterAll {
# clean up
$remove = Remove-AzPolicyAssignment -Name $test1 -Scope $rg.ResourceId -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -BackwardCompatible) -and $remove
$remove = Remove-AzPolicyAssignment -Name $test1 -Scope $env.scope -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $env.scope -BackwardCompatible) -and $remove
$remove = (Remove-AzPolicySetDefinition -Name $policySetDefName -Force -BackwardCompatible) -and $remove
$remove = (Remove-AzPolicyDefinition -Name $policyDefName1 -Force -BackwardCompatible) -and $remove
$remove = (Remove-AzPolicyDefinition -Name $policyDefName2 -Force -BackwardCompatible) -and $remove
$remove = (Remove-ResourceGroup -Name $rgname) -and $remove

Assert-AreEqual True $remove

Expand Down
Original file line number Diff line number Diff line change
@@ -1,33 +1,32 @@
# setup the Pester environment for policy backcompat tests
. (Join-Path $PSScriptRoot 'Common.ps1') 'Backcompat-PolicyAssignmentEnforcementMode'

Describe 'Backcompat-PolicyAssignmentEnforcementMode' -Tag 'LiveOnly' {
Describe 'Backcompat-PolicyAssignmentEnforcementMode' {

BeforeAll {
# setup
$rgname = Get-ResourceGroupName
$rgname = $env.rgname
$policyName = Get-ResourceName
$testPA = Get-ResourceName
$test2 = Get-ResourceName
$location = "westus"

# make a new resource group and policy definition
$rg = New-ResourceGroup -Name $rgname -Location $location
$policy = New-AzPolicyDefinition -Name $policyName -Policy "$testFilesFolder\SamplePolicyDefinition.json" -Description $description -BackwardCompatible

# assign the policy definition to the resource group
$actual = New-AzPolicyAssignment -Name $testPA -PolicyDefinition $policy -Scope $rg.ResourceId -Description $description -Location $location -EnforcementMode DoNotEnforce -BackwardCompatible
$actual = New-AzPolicyAssignment -Name $testPA -PolicyDefinition $policy -Scope $env.scope -Description $description -Location $location -EnforcementMode DoNotEnforce -BackwardCompatible
}

It 'make a policy assignment' {
{
# get the assignment back and validate
$expected = Get-AzPolicyAssignment -Name $testPA -Scope $rg.ResourceId -BackwardCompatible
$expected = Get-AzPolicyAssignment -Name $testPA -Scope $env.scope -BackwardCompatible
Assert-AreEqual $expected.Name $actual.Name
Assert-AreEqual Microsoft.Authorization/policyAssignments $actual.ResourceType
Assert-AreEqual $expected.PolicyAssignmentId $actual.PolicyAssignmentId
Assert-AreEqual $expected.Properties.PolicyDefinitionId $policy.PolicyDefinitionId
Assert-AreEqual $expected.Properties.Scope $rg.ResourceId
Assert-AreEqual $expected.Properties.Scope $env.scope
Assert-AreEqual $expected.Properties.EnforcementMode $actual.Properties.EnforcementMode
Assert-AreEqual $expected.Properties.EnforcementMode $enforcementModeDoNotEnforce
Assert-AreEqual $location $actual.Location
Expand Down Expand Up @@ -64,7 +63,7 @@ Describe 'Backcompat-PolicyAssignmentEnforcementMode' -Tag 'LiveOnly' {
It 'make another policy assignment without enforcement mode' {
{
# make another policy assignment without an enforcementMode, validate default mode is set
$withoutEnforcementMode = New-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -PolicyDefinition $policy -Description $description -BackwardCompatible
$withoutEnforcementMode = New-AzPolicyAssignment -Name $test2 -Scope $env.scope -PolicyDefinition $policy -Description $description -BackwardCompatible
Assert-AreEqual $enforcementModeDefault $withoutEnforcementMode.Properties.EnforcementMode

# set an enforcement mode to the new assignment using the SET cmdlet
Expand All @@ -80,17 +79,16 @@ Describe 'Backcompat-PolicyAssignmentEnforcementMode' -Tag 'LiveOnly' {
It 'enforcement mode in policy assignment list' {
{
# verify enforcement mode is returned in collection GET
$list = Get-AzPolicyAssignment -Scope $rg.ResourceId -BackwardCompatible | ?{ $_.Name -in @($testPA, $test2) }
$list = Get-AzPolicyAssignment -Scope $env.scope -BackwardCompatible | ?{ $_.Name -in @($testPA, $test2) }
Assert-AreEqual 2 @($list.Properties.EnforcementMode | Select -Unique).Count
} | Should -Not -Throw
}

AfterAll {
# clean up
$remove = Remove-AzPolicyAssignment -Name $testPA -Scope $rg.ResourceId -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -BackwardCompatible) -and $remove
$remove = Remove-AzPolicyAssignment -Name $testPA -Scope $env.scope -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $env.scope -BackwardCompatible) -and $remove
$remove = (Remove-AzPolicyDefinition -Name $policyName -Force -BackwardCompatible) -and $remove
$remove = (Remove-ResourceGroup -Name $rgname) -and $remove
Assert-AreEqual True $remove

Write-Host -ForegroundColor Magenta "Cleanup complete."
Expand Down
Original file line number Diff line number Diff line change
@@ -1,32 +1,31 @@
# setup the Pester environment for policy backcompat tests
. (Join-Path $PSScriptRoot 'Common.ps1') 'Backcompat-PolicyAssignmentSystemAssignedIdentity'

Describe 'Backcompat-PolicyAssignmentSystemAssignedIdentity' -Tag 'LiveOnly' {
Describe 'Backcompat-PolicyAssignmentSystemAssignedIdentity' {

BeforeAll {
# setup
$rgname = Get-ResourceGroupName
$rgname = $env.rgname
$policyName = Get-ResourceName
$testPA = Get-ResourceName
$test2 = Get-ResourceName
$location = "westus"

# make a new resource group and policy definition
$rg = New-ResourceGroup -Name $rgname -Location $location
$policy = New-AzPolicyDefinition -Name $policyName -Policy "$testFilesFolder\SamplePolicyDefinition.json" -Description $description -BackwardCompatible
# assign the policy definition with system MSI to the resource group
$actual = New-AzPolicyAssignment -Name $testPA -PolicyDefinition $policy -Scope $rg.ResourceId -Description $description -IdentityType SystemAssigned -Location $location -BackwardCompatible
$actual = New-AzPolicyAssignment -Name $testPA -PolicyDefinition $policy -Scope $env.scope -Description $description -IdentityType SystemAssigned -Location $location -BackwardCompatible
}

It 'make a policy assignment at RG scope with MSI' {
{
# get the assignment back and validate
$expected = Get-AzPolicyAssignment -Name $testPA -Scope $rg.ResourceId -BackwardCompatible
$expected = Get-AzPolicyAssignment -Name $testPA -Scope $env.scope -BackwardCompatible
Assert-AreEqual $expected.Name $actual.Name
Assert-AreEqual Microsoft.Authorization/policyAssignments $actual.ResourceType
Assert-AreEqual $expected.PolicyAssignmentId $actual.PolicyAssignmentId
Assert-AreEqual $expected.Properties.PolicyDefinitionId $policy.PolicyDefinitionId
Assert-AreEqual $expected.Properties.Scope $rg.ResourceId
Assert-AreEqual $expected.Properties.Scope $env.scope
Assert-AreEqual "SystemAssigned" $expected.Identity.IdentityType
Assert-NotNull $expected.Identity.PrincipalId
Assert-NotNull $expected.Identity.TenantId
Expand Down Expand Up @@ -62,7 +61,7 @@ Describe 'Backcompat-PolicyAssignmentSystemAssignedIdentity' -Tag 'LiveOnly' {
It 'make another policy assignment without MSI' {
{
# make another policy assignment without an identity
$withoutIdentityResult = New-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -PolicyDefinition $policy -Description $description -BackwardCompatible
$withoutIdentityResult = New-AzPolicyAssignment -Name $test2 -Scope $env.scope -PolicyDefinition $policy -Description $description -BackwardCompatible
Assert-Null $withoutIdentityResult.Identity
Assert-Null $withoutIdentityResult.Location
# add an identity to the new assignment using set
Expand All @@ -78,7 +77,7 @@ Describe 'Backcompat-PolicyAssignmentSystemAssignedIdentity' -Tag 'LiveOnly' {
It 'list policy assignment with MSI' {
{
# verify identity is returned in collection GET
$list = Get-AzPolicyAssignment -Scope $rg.ResourceId -BackwardCompatible | ?{ $_.Name -in @($testPA, $test2) }
$list = Get-AzPolicyAssignment -Scope $env.scope -BackwardCompatible | ?{ $_.Name -in @($testPA, $test2) }
Assert-AreEqual "SystemAssigned" ($list.Identity.IdentityType | Select -Unique)
Assert-AreEqual 2 @($list.Identity.PrincipalId | Select -Unique).Count
Assert-AreEqual 1 @($list.Identity.TenantId | Select -Unique).Count
Expand All @@ -89,10 +88,9 @@ Describe 'Backcompat-PolicyAssignmentSystemAssignedIdentity' -Tag 'LiveOnly' {

AfterAll {
# clean up
$remove = Remove-AzPolicyAssignment -Name $testPA -Scope $rg.ResourceId -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $rg.ResourceId -BackwardCompatible) -and $remove
$remove = Remove-AzPolicyAssignment -Name $testPA -Scope $env.scope -BackwardCompatible
$remove = (Remove-AzPolicyAssignment -Name $test2 -Scope $env.scope -BackwardCompatible) -and $remove
$remove = (Remove-AzPolicyDefinition -Name $policyName -Force -BackwardCompatible) -and $remove
$remove = (Remove-ResourceGroup -Name $rgname) -and $remove
Assert-AreEqual True $remove

Write-Host -ForegroundColor Magenta "Cleanup complete."
Expand Down
Loading

0 comments on commit f43da67

Please sign in to comment.