add microsoft_network_applicationGateways_zones rule

Azure · Jan 24, 2025 · 7a8e1cd · 7a8e1cd
1 parent a160a92
commit 7a8e1cd
Show file tree

Hide file tree

Showing 3 changed files with 126 additions and 4 deletions.
diff --git a/...e-Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_sku_name.rego b/...e-Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_sku_name.rego
@@ -1,10 +1,10 @@
-package Azure_Proactive_Resiliency_Library_v2.azurerm_application_gateway
+package Azure_Proactive_Resiliency_Library_v2.Microsoft_Network_applicationGateways
 
-valid_azapi_sku(resource) {
+valid_sku(resource) {
     resource.change.after.body.properties.sku.name == "Standard_v2"
 }
 
-valid_azapi_sku(resource) {
+valid_sku(resource) {
     resource.change.after.body.properties.sku.name == "WAF_v2"
 }
 
@@ -15,7 +15,7 @@ deny[reason] {
     resource.type == "azapi_resource"
     regex.match(`^Microsoft.Network/applicationGateways@`, resource.change.after.type)
     data.utils.is_create_or_update(resource.change.actions)
-    not valid_azapi_sku(resource)
+    not valid_sku(resource)
 
     reason := sprintf("Azure-Proactive-Resiliency-Library-v2: '%s' `azapi_resource` must have 'body.properties.sku.name' set to 'Standard_v2' or 'WAF_v2': https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/azure-resources/Network/applicationGateways/#migrate-to-application-gateway-v2", [resource.address])
 }
diff --git a/...Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_zones.mock.json b/...Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_zones.mock.json
@@ -0,0 +1,104 @@
+{
+  "mock": {
+    "3zones": {
+      "resource_changes": [
+        {
+          "address": "azapi_resource.gw",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "name": "gw",
+          "provider_name": "registry.terraform.io/azure/azapi",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "zones": [
+                  "1",
+                  "2",
+                  "3"
+                ]
+              },
+              "name": "example-appgateway",
+              "type": "Microsoft.Network/applicationGateways@2024-03-01"
+            }
+          }
+        }
+      ]
+    },
+    "2zones": {
+      "resource_changes": [
+        {
+          "address": "azapi_resource.gw",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "name": "gw",
+          "provider_name": "registry.terraform.io/azure/azapi",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "zones": [
+                  "1",
+                  "2"
+                ]
+              },
+              "name": "example-appgateway",
+              "type": "Microsoft.Network/applicationGateways@2024-03-01"
+            }
+          }
+        }
+      ]
+    },
+    "invalid_no_zones": {
+      "resource_changes": [
+        {
+          "address": "azapi_resource.gw",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "name": "gw",
+          "provider_name": "registry.terraform.io/azure/azapi",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+              },
+              "name": "example-appgateway",
+              "type": "Microsoft.Network/applicationGateways@2024-03-01"
+            }
+          }
+        }
+      ]
+    },
+    "invalid_no_enough_zones":{
+      "resource_changes": [
+        {
+          "address": "azapi_resource.gw",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "name": "gw",
+          "provider_name": "registry.terraform.io/azure/azapi",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "zones": [
+                  "1"
+                ]
+              },
+              "name": "example-appgateway",
+              "type": "Microsoft.Network/applicationGateways@2024-03-01"
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/...tive-Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_zones.rego b/...tive-Resiliency-Library-v2/azapi/network/microsoft_network_applicationGateways_zones.rego
@@ -0,0 +1,18 @@
+package Azure_Proactive_Resiliency_Library_v2.Microsoft_Network_applicationGateways
+
+valid_zones(after) {
+    after.body.zones
+    count(after.body.zones) >= 2
+}
+
+deny[reason] {
+    tfplan := data.utils.tfplan(input)
+    resource := tfplan.resource_changes[_]
+    resource.mode == "managed"
+    resource.type == "azapi_resource"
+    regex.match(`^Microsoft.Network/applicationGateways@`, resource.change.after.type)
+    data.utils.is_create_or_update(resource.change.actions)
+    not valid_zones(resource.change.after)
+
+    reason := sprintf("Azure-Proactive-Resiliency-Library-v2: '%s' `azapi_resource` must have must have configured to use at least 2 Availability Zones: https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/azure-resources/Network/applicationGateways/#deploy-application-gateway-in-a-zone-redundant-configuration", [resource.address])
+}