diff --git a/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.mock.json b/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.mock.json new file mode 100644 index 0000000..56fc39d --- /dev/null +++ b/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.mock.json @@ -0,0 +1,42 @@ +{ + "mock": { + "GRS": { + "resource_changes": [ + { + "address": "azurerm_storage_account.example", + "mode": "managed", + "type": "azurerm_storage_account", + "name": "example", + "provider_name": "registry.terraform.io/hashicorp/azurerm", + "change": { + "actions": [ + "create" + ], + "after": { + "account_replication_type": "GRS" + } + } + } + ] + }, + "invalid_LRS": { + "resource_changes": [ + { + "address": "azurerm_storage_account.example", + "mode": "managed", + "type": "azurerm_storage_account", + "name": "example", + "provider_name": "registry.terraform.io/hashicorp/azurerm", + "change": { + "actions": [ + "create" + ], + "after": { + "account_replication_type": "LRS" + } + } + } + ] + } + } +} \ No newline at end of file diff --git a/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.rego b/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.rego new file mode 100644 index 0000000..84e1437 --- /dev/null +++ b/policy/Azure-Proactive-Resiliency-Library-v2/azurerm/storage/azurerm_storage_account_account_replication_type.rego @@ -0,0 +1,14 @@ +package Azure_Proactive_Resiliency_Library_v2.storage_accounts_are_zone_or_region_redundant + +import rego.v1 + +valid_azurerm_account_replication_type(resource) if { + resource.values.account_replication_type != "LRS" +} + +deny_storage_accounts_are_zone_or_region_redundant contains reason if { + resource := data.utils.resource(input, "azurerm_storage_account")[_] + not valid_azurerm_account_replication_type(resource) + + reason := sprintf("Azure-Proactive-Resiliency-Library-v2: '%s' `azurerm_storage_account` must not have 'account_replication_type' set to 'LRS': https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/azure-resources/Storage/storageAccounts/#ensure-that-storage-accounts-are-zone-or-region-redundant", [resource.address]) +} \ No newline at end of file