add azurerm_application_gateway_zones policy

Azure · Jan 24, 2025 · d1ed4b1 · d1ed4b1
1 parent 9b5a192
commit d1ed4b1
Show file tree

Hide file tree

Showing 2 changed files with 86 additions and 0 deletions.
diff --git a/...oactive-Resiliency-Library-v2/azurerm/network/azurerm_application_gateway_zones.mock.json b/...oactive-Resiliency-Library-v2/azurerm/network/azurerm_application_gateway_zones.mock.json
@@ -0,0 +1,69 @@
+{
+  "mock": {
+    "default": {
+      "resource_changes": [
+        {
+          "address": "azurerm_application_gateway.network",
+          "mode": "managed",
+          "type": "azurerm_application_gateway",
+          "name": "network",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "before": null,
+            "after": {
+              "resource_group_name": "example-resources",
+              "zones": [
+                1,
+                2
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "invalid_no_zones": {
+      "resource_changes": [
+        {
+          "address": "azurerm_application_gateway.network",
+          "mode": "managed",
+          "type": "azurerm_application_gateway",
+          "name": "network",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "before": null,
+            "after": {
+              "resource_group_name": "example-resources"
+            }
+          }
+        }
+      ]
+    },
+    "invalid_no_enough_zones": {
+      "resource_changes": [
+        {
+          "address": "azurerm_application_gateway.network",
+          "mode": "managed",
+          "type": "azurerm_application_gateway",
+          "name": "network",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "before": null,
+            "after": {
+              "resource_group_name": "example-resources",
+              "zones": [1]
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/...re-Proactive-Resiliency-Library-v2/azurerm/network/azurerm_application_gateway_zones.rego b/...re-Proactive-Resiliency-Library-v2/azurerm/network/azurerm_application_gateway_zones.rego
@@ -0,0 +1,17 @@
+package Azure_Proactive_Resiliency_Library_v2.azurerm_application_gateway
+
+valid_zones(after) {
+    after.zones
+    count(after.zones) >= 2
+}
+
+deny[reason] {
+    tfplan := data.utils.tfplan(input)
+    resource := tfplan.resource_changes[_]
+    resource.mode == "managed"
+    resource.type == "azurerm_application_gateway"
+    data.utils.is_create_or_update(resource.change.actions)
+    not valid_zones(resource.change.after)
+
+    reason := sprintf("Azure-Proactive-Resiliency-Library-v2: '%s' `azurerm_application_gateway` must have configured to use at least 2 Availability Zones: https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/azure-resources/Network/applicationGateways/#deploy-application-gateway-in-a-zone-redundant-configuration", [resource.address])
+}