new rule for azurerm_storage_account

Azure · Feb 13, 2025 · f266d96 · f266d96
1 parent 8c1571b
commit f266d96
Show file tree

Hide file tree

Showing 2 changed files with 56 additions and 0 deletions.
diff --git a/...ncy-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.mock.json b/...ncy-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.mock.json
@@ -0,0 +1,42 @@
+{
+  "mock": {
+    "GRS": {
+      "resource_changes": [
+        {
+          "address": "azurerm_storage_account.example",
+          "mode": "managed",
+          "type": "azurerm_storage_account",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "account_replication_type": "GRS"
+            }
+          }
+        }
+      ]
+    },
+    "invalid_LRS": {
+      "resource_changes": [
+        {
+          "address": "azurerm_storage_account.example",
+          "mode": "managed",
+          "type": "azurerm_storage_account",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "account_replication_type": "LRS"
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/...siliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.rego b/...siliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.rego
@@ -0,0 +1,14 @@
+package Azure_Proactive_Resiliency_Library_v2.storage_accounts_are_zone_or_region_redundant
+
+import rego.v1
+
+valid_azurerm_account_replication_type(resource) if {
+    resource.values.account_replication_type != "LRS"
+}
+
+deny_storage_accounts_are_zone_or_region_redundant contains reason if {
+    resource := data.utils.resource(input, "azurerm_storage_account")[_]
+    not valid_azurerm_account_replication_type(resource)
+
+    reason := sprintf("Azure-Proactive-Resiliency-Library-v2: '%s' `azurerm_storage_account` must not have 'account_replication_type' set to 'LRS': https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/azure-resources/Storage/storageAccounts/#ensure-that-storage-accounts-are-zone-or-region-redundant", [resource.address])
+}