|
| 1 | +# ---------------------------------------------------------------------------------- |
| 2 | +# |
| 3 | +# Copyright Microsoft Corporation |
| 4 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +# you may not use this file except in compliance with the License. |
| 6 | +# You may obtain a copy of the License at |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# Unless required by applicable law or agreed to in writing, software |
| 9 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 10 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 11 | +# See the License for the specific language governing permissions and |
| 12 | +# limitations under the License. |
| 13 | +# ---------------------------------------------------------------------------------- |
| 14 | + |
| 15 | +# This script will set up the necessary resources and policies to record the policy insights tests. |
| 16 | +# This makes things a lot easier, since the tests require specific policies to be present in various scopes |
| 17 | +# as well as large number of non-compliant resources in order to test things like paging. |
| 18 | +# Both the tests and this script use the resource details defined in the common.ps1 script. |
| 19 | +# Before running env setup, make sure you have access to the MG and Subscription defined in common.ps1 (or change them to MG\subscription you do have acess to) |
| 20 | +. "..\ScenarioTests\Common.ps1" |
| 21 | + |
| 22 | +# Note: Once the script is finished, wait for full compliance results before running the tests. |
| 23 | +$subscriptionId = $(Get-TestSubscriptionId) |
| 24 | +$managementGroupId = $(Get-TestManagementGroupName) |
| 25 | +$emptyResourceGroupName = $(Get-EmptyTestResourceGroupName) |
| 26 | +$resourceGroup1 = $(Get-FirstTestResourceGroupName) |
| 27 | +$resourceGroup2 = $(Get-SecondTestResourceGroupName) |
| 28 | + |
| 29 | +# Connect |
| 30 | +Connect-AzAccount -DeviceCode |
| 31 | +Set-AzContext -SubscriptionId $subscriptionId |
| 32 | + |
| 33 | +#Create an empty RG |
| 34 | +Get-AzResourceGroup -Name $emptyResourceGroupName -ErrorVariable rgNotPresent -ErrorAction SilentlyContinue |
| 35 | +if ($rgNotPresent) { |
| 36 | + New-AzResourceGroup -Name $emptyResourceGroupName -Location "eastus" |
| 37 | +} |
| 38 | + |
| 39 | +# Create 2 RGs |
| 40 | +foreach ($resourceGroupName in @($resourceGroup1, $resourceGroup2)) { |
| 41 | + Get-AzResourceGroup -Name $resourceGroupName -ErrorVariable rgNotPresent -ErrorAction SilentlyContinue |
| 42 | + if ($rgNotPresent) { |
| 43 | + New-AzResourceGroup -Name $resourceGroupName -Location "northcentralus" |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +# Create DINE and modify definitions (MG-level) |
| 48 | +$deployIfNotExistsPolicyDefinition = New-AzPolicyDefinition -Name $(Get-TestDINEPolicyDefinitionName) -Policy "$PSScriptRoot/NSG_DINE_neverCompliant_policyDefinition.json" -DisplayName "PS cmdlet tests: never compliant DINE policy" -Mode Indexed -ManagementGroupName $managementGroupId |
| 49 | +$modifyPolicyDefinition = New-AzPolicyDefinition -Name $(Get-TestModifyPolicyDefinitionName) -Policy "$PSScriptRoot/NSG_modify_neverCompliant_policyDefinition.json" -DisplayName "PS cmdlet tests: never compliant modify policy" -Mode Indexed -ManagementGroupName $managementGroupId |
| 50 | + |
| 51 | +# Assign the DINE policy in both MG and subscription level |
| 52 | +$mgDINEAssignment = New-AzPolicyAssignment -Name $(Get-TestManagementGroupDINEAssignmentName) -Scope "/providers/microsoft.management/managementgroups/$managementGroupId" -DisplayName "PS cmdlet tests: never compliant DINE policy (MG)" -PolicyDefinition $deployIfNotExistsPolicyDefinition -AssignIdentity -Location "westus2" |
| 53 | +$subDINEAssignment = New-AzPolicyAssignment -Name $(Get-TestSubscriptionDINEAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: never compliant DINE policy (Sub)" -PolicyDefinition $deployIfNotExistsPolicyDefinition -AssignIdentity -Location "westus2" |
| 54 | + |
| 55 | +# Assign the modify policy to the subscription |
| 56 | +$subModifyAssignment = New-AzPolicyAssignment -Name $(Get-TestSubscriptionModifyAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: never compliant modify policy" -PolicyDefinition $modifyPolicyDefinition -AssignIdentity -Location "westus2" |
| 57 | + |
| 58 | +# Give the assignments permissions to perform remediations |
| 59 | +Start-Sleep -Seconds 60 |
| 60 | +New-AzRoleAssignment -Scope "/providers/microsoft.management/managementgroups/$managementGroupId" -ObjectId $mgDINEAssignment.Identity.principalId -RoleDefinitionName "Key Vault Contributor" |
| 61 | +New-AzRoleAssignment -Scope "/subscriptions/$subscriptionId" -ObjectId $subDINEAssignment.Identity.principalId -RoleDefinitionName "Key Vault Contributor" |
| 62 | +New-AzRoleAssignment -Scope "/subscriptions/$subscriptionId" -ObjectId $subModifyAssignment.Identity.principalId -RoleDefinitionName "Tag Contributor" |
| 63 | + |
| 64 | +# Trigger 101 modify remediations with different names (don't care about the outcome, just want to have 101 remediation entities we can query) |
| 65 | +New-AzResourceGroupDeployment -ResourceGroupName $resourceGroup1 -TemplateFile "$PSScriptRoot/CreateRemediationsTemplate.json" -remediationCount 101 -assignmentId $subModifyAssignment.ResourceId |
| 66 | + |
| 67 | +# Create a subscription-level audit policy definition |
| 68 | +$partiallyCompliantAuditPolicyDefinition = New-AzPolicyDefinition -Name $(Get-TestAuditPolicyDefinitionName) -Policy "$PSScriptRoot/NSG_audit_partiallyCompliant_policyDefinition.json" -DisplayName "PS cmdlet tests: partially compliant audit policy" -Mode Indexed -SubscriptionId $subscriptionId |
| 69 | + |
| 70 | +# Assign the audit policy to subscription and RG levels |
| 71 | +New-AzPolicyAssignment -Name $(Get-TestSubscriptionAuditAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: partially compliant audit policy (Sub)" -PolicyDefinition $partiallyCompliantAuditPolicyDefinition |
| 72 | +New-AzPolicyAssignment -Name $(Get-TestResourceGroupAuditAssignmentName) -Scope "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup1" -DisplayName "PS cmdlet tests: partially compliant audit policy (RG)" -PolicyDefinition $partiallyCompliantAuditPolicyDefinition |
| 73 | + |
| 74 | +# Create an initiative for the audit policy |
| 75 | +$policyDefinitions = @" |
| 76 | +[ |
| 77 | + { |
| 78 | + "policyDefinitionId": "$($partiallyCompliantAuditPolicyDefinition.ResourceId)" |
| 79 | + } |
| 80 | +] |
| 81 | +"@ |
| 82 | + |
| 83 | +$policySetDefinition = New-AzPolicySetDefinition -Name $(Get-TestPolicySetDefinitionName) -DisplayName "PS cmdlet tests: test initiative" -PolicyDefinition $policyDefinitions -SubscriptionId $subscriptionId |
| 84 | + |
| 85 | +# Assign the initiative to the subscription |
| 86 | +New-AzPolicyAssignment -Name $(Get-TestSubscriptionAuditInitiativeAssignmentName) -Scope "/subscriptions/$subscriptionId" -DisplayName "PS cmdlet tests: initiative with audit policy (Sub)" -PolicySetDefinition $policySetDefinition |
| 87 | + |
| 88 | +Start-Sleep -Seconds 60 |
| 89 | + |
| 90 | +# In each RG, create 510 NSGs (will take a while) |
| 91 | +foreach ($resourceGroupName in @($resourceGroup1, $resourceGroup2)) { |
| 92 | + New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateFile "$PSScriptRoot/CreateNSGsTemplate.json" -resourceCount 510 -resourceNamePrefix $(Get-TestResourceNamePrefix) |
| 93 | +} |
0 commit comments