Skip to content

Commit aefbdd7

Browse files
authored
More explicit explanation of [*] alias scenarios
The original paragraph introduced three different scenarios that use the [*] alias field condition, but it never came back and explained which one is which one. Being no expert on logical statements, it took me some time to bite through, and when I did, I felt like I would pass this on. :)
1 parent 406cd6a commit aefbdd7

File tree

1 file changed

+14
-13
lines changed

1 file changed

+14
-13
lines changed

articles/governance/policy/how-to/author-policies-for-arrays.md

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -163,8 +163,9 @@ expression. To resolve this error message, change `equals` to either `in` or `no
163163

164164
Aliases that have **\[\*\]** attached to their name indicate the **type** is an _array_. Instead of
165165
evaluating the value of the entire array, **\[\*\]** makes it possible to evaluate each element of
166-
the array. There are three standard scenarios this per item evaluation is useful in: None, Any, and
167-
All. For complex scenarios, use [count](../concepts/definition-structure.md#count).
166+
the array individually, with logical AND between them. There are three standard scenarios this per
167+
item evaluation is useful in: _None_, _Any_, or _All_ elements match.
168+
For complex scenarios, use [count](../concepts/definition-structure.md#count).
168169

169170
The policy engine triggers the **effect** in **then** only when the **if** rule evaluates as true.
170171
This fact is important to understand in context of the way **\[\*\]** evaluates each individual
@@ -209,16 +210,16 @@ For each condition example below, replace `<field>` with `"field": "Microsoft.St
209210
The following outcomes are the result of the combination of the condition and the example policy
210211
rule and array of existing values above:
211212

212-
|Condition |Outcome |Explanation |
213-
|-|-|-|
214-
|`{<field>,"notEquals":"127.0.0.1"}` |Nothing |One array element evaluates as false (127.0.0.1 != 127.0.0.1) and one as true (127.0.0.1 != 192.168.1.1), so the **notEquals** condition is _false_ and the effect isn't triggered. |
215-
|`{<field>,"notEquals":"10.0.4.1"}` |Policy effect |Both array elements evaluate as true (10.0.4.1 != 127.0.0.1 and 10.0.4.1 != 192.168.1.1), so the **notEquals** condition is _true_ and the effect is triggered. |
216-
|`"not":{<field>,"Equals":"127.0.0.1"}` |Policy effect |One array element evaluates as true (127.0.0.1 == 127.0.0.1) and one as false (127.0.0.1 == 192.168.1.1), so the **Equals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
217-
|`"not":{<field>,"Equals":"10.0.4.1"}` |Policy effect |Both array elements evaluate as false (10.0.4.1 == 127.0.0.1 and 10.0.4.1 == 192.168.1.1), so the **Equals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
218-
|`"not":{<field>,"notEquals":"127.0.0.1" }` |Policy effect |One array element evaluates as false (127.0.0.1 != 127.0.0.1) and one as true (127.0.0.1 != 192.168.1.1), so the **notEquals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
219-
|`"not":{<field>,"notEquals":"10.0.4.1"}` |Nothing |Both array elements evaluate as true (10.0.4.1 != 127.0.0.1 and 10.0.4.1 != 192.168.1.1), so the **notEquals** condition is _true_. The logical operator evaluates as false (**not** _true_), so the effect isn't triggered. |
220-
|`{<field>,"Equals":"127.0.0.1"}` |Nothing |One array element evaluates as true (127.0.0.1 == 127.0.0.1) and one as false (127.0.0.1 == 192.168.1.1), so the **Equals** condition is _false_ and the effect isn't triggered. |
221-
|`{<field>,"Equals":"10.0.4.1"}` |Nothing |Both array elements evaluate as false (10.0.4.1 == 127.0.0.1 and 10.0.4.1 == 192.168.1.1), so the **Equals** condition is _false_ and the effect isn't triggered. |
213+
|Condition |Outcome | Scenario |Explanation |
214+
|-|-|-|-|
215+
|`{<field>,"notEquals":"127.0.0.1"}` |Nothing |None match |One array element evaluates as false (127.0.0.1 != 127.0.0.1) and one as true (127.0.0.1 != 192.168.1.1), so the **notEquals** condition is _false_ and the effect isn't triggered. |
216+
|`{<field>,"notEquals":"10.0.4.1"}` |Policy effect |None match |Both array elements evaluate as true (10.0.4.1 != 127.0.0.1 and 10.0.4.1 != 192.168.1.1), so the **notEquals** condition is _true_ and the effect is triggered. |
217+
|`"not":{<field>,"notEquals":"127.0.0.1" }` |Policy effect |One or more match |One array element evaluates as false (127.0.0.1 != 127.0.0.1) and one as true (127.0.0.1 != 192.168.1.1), so the **notEquals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
218+
|`"not":{<field>,"notEquals":"10.0.4.1"}` |Nothing |One or more match |Both array elements evaluate as true (10.0.4.1 != 127.0.0.1 and 10.0.4.1 != 192.168.1.1), so the **notEquals** condition is _true_. The logical operator evaluates as false (**not** _true_), so the effect isn't triggered. |
219+
|`"not":{<field>,"Equals":"127.0.0.1"}` |Policy effect |Not all match |One array element evaluates as true (127.0.0.1 == 127.0.0.1) and one as false (127.0.0.1 == 192.168.1.1), so the **Equals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
220+
|`"not":{<field>,"Equals":"10.0.4.1"}` |Policy effect |Not all match |Both array elements evaluate as false (10.0.4.1 == 127.0.0.1 and 10.0.4.1 == 192.168.1.1), so the **Equals** condition is _false_. The logical operator evaluates as true (**not** _false_), so the effect is triggered. |
221+
|`{<field>,"Equals":"127.0.0.1"}` |Nothing |All match |One array element evaluates as true (127.0.0.1 == 127.0.0.1) and one as false (127.0.0.1 == 192.168.1.1), so the **Equals** condition is _false_ and the effect isn't triggered. |
222+
|`{<field>,"Equals":"10.0.4.1"}` |Nothing |All match |Both array elements evaluate as false (10.0.4.1 == 127.0.0.1 and 10.0.4.1 == 192.168.1.1), so the **Equals** condition is _false_ and the effect isn't triggered. |
222223

223224
## The append effect and arrays
224225

@@ -238,4 +239,4 @@ For more information, see the [append examples](../concepts/effects.md#append-ex
238239
- Review [Understanding policy effects](../concepts/effects.md).
239240
- Understand how to [programmatically create policies](programmatically-create.md).
240241
- Learn how to [remediate non-compliant resources](remediate-resources.md).
241-
- Review what a management group is with [Organize your resources with Azure management groups](../../management-groups/overview.md).
242+
- Review what a management group is with [Organize your resources with Azure management groups](../../management-groups/overview.md).

0 commit comments

Comments
 (0)