Skip to content
This repository was archived by the owner on Jan 30, 2025. It is now read-only.

Commit c1a3b99

Browse files
SenthuranSivananthanSenthuranSivananthan
authored
Flexible policy deployment using PowerShell & GitHub Actions (Azure#300)
1 parent 0ce5c1a commit c1a3b99

File tree

4 files changed

+353
-60
lines changed

4 files changed

+353
-60
lines changed

‎.github/workflows/0-everything.yml‎

Lines changed: 112 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -121,22 +121,123 @@ jobs:
121121
-GitHubRepo ${env:GITHUB_REPOSITORY} `
122122
-GitHubRef ${env:GITHUB_REF}
123123
124-
Policy:
124+
Custom_Policy_Definitions:
125+
name: Custom policy definitions
126+
needs: Logging
127+
128+
runs-on: ubuntu-latest
129+
steps:
130+
131+
- name: Checkout
132+
uses: actions/checkout@v3
133+
134+
- name: Configure PowerShell modules
135+
run: |
136+
Install-Module Az -Force
137+
Install-Module powershell-yaml -Force
138+
139+
- name: Deploy policy definitions
140+
run: |
141+
./RunWorkflows.ps1 `
142+
-DeployCustomPolicyDefinitions `
143+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
144+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
145+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
146+
-GitHubRef ${env:GITHUB_REF}
147+
148+
Custom_Policy_Set_Definitions:
149+
name: Define custom
150+
needs: Custom_Policy_Definitions
151+
152+
strategy:
153+
matrix:
154+
policySetDefinitionName:
155+
- AKS
156+
- DefenderForCloud
157+
- LogAnalytics
158+
- Network
159+
- DNSPrivateEndpoints
160+
- Tags
161+
fail-fast: false
162+
163+
runs-on: ubuntu-latest
164+
steps:
165+
166+
- name: Checkout
167+
uses: actions/checkout@v3
168+
169+
- name: Configure PowerShell modules
170+
run: |
171+
Install-Module Az -Force
172+
Install-Module powershell-yaml -Force
173+
174+
- name: Deploy policy set definition
175+
run: |
176+
./RunWorkflows.ps1 `
177+
-DeployCustomPolicySetDefinitions `
178+
-CustomPolicySetDefinitionNames '${{ matrix.policySetDefinitionName }}' `
179+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
180+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
181+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
182+
-GitHubRef ${env:GITHUB_REF}
183+
184+
Custom_Policy_Set_Assignments:
185+
name: Assign custom
125186
needs:
126-
- Logging
187+
- Custom_Policy_Definitions
188+
- Custom_Policy_Set_Definitions
127189

128-
name: Policy
190+
strategy:
191+
matrix:
192+
policySetAssignmentName:
193+
- AKS
194+
- DefenderForCloud
195+
- LogAnalytics
196+
- Network
197+
- Tags
198+
fail-fast: false
129199

130200
runs-on: ubuntu-latest
201+
steps:
202+
203+
- name: Checkout
204+
uses: actions/checkout@v3
205+
206+
- name: Configure PowerShell modules
207+
run: |
208+
Install-Module Az -Force
209+
Install-Module powershell-yaml -Force
210+
211+
- name: Deploy policy set assignment
212+
run: |
213+
./RunWorkflows.ps1 `
214+
-DeployCustomPolicySetAssignments `
215+
-CustomPolicySetAssignmentNames '${{ matrix.policySetAssignmentName }}' `
216+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
217+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
218+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
219+
-GitHubRef ${env:GITHUB_REF}
220+
221+
Builtin_Policy_Set_Assignments:
222+
name: Assign built-in
223+
needs: Logging
131224

132225
strategy:
133226
matrix:
134-
policyType:
135-
- DeployBuiltInPolicy
136-
- DeployCustomPolicy
227+
policySetAssignmentName:
228+
- asb
229+
- nist80053r4
230+
- nist80053r5
231+
- pbmm
232+
- cis-msft-130
233+
- fedramp-moderate
234+
- hitrust-hipaa
235+
- location
137236
fail-fast: false
138237

238+
runs-on: ubuntu-latest
139239
steps:
240+
140241
- name: Checkout
141242
uses: actions/checkout@v3
142243

@@ -145,18 +246,20 @@ jobs:
145246
Install-Module Az -Force
146247
Install-Module powershell-yaml -Force
147248
148-
- name: Deploy Policy
249+
- name: Deploy policy set assignment
149250
run: |
150251
./RunWorkflows.ps1 `
151-
-${{ matrix.policyType }} `
252+
-DeployBuiltinPolicySetAssignments `
253+
-BuiltinPolicySetAssignmentNames '${{ matrix.policySetAssignmentName }}' `
152254
-EnvironmentName '${{github.event.inputs.environmentName}}' `
153255
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
154256
-GitHubRepo ${env:GITHUB_REPOSITORY} `
155257
-GitHubRef ${env:GITHUB_REF}
156258
157259
HubNetworking:
158260
needs:
159-
- Policy
261+
- Custom_Policy_Set_Assignments
262+
- Builtin_Policy_Set_Assignments
160263

161264
name: Hub Networking (${{github.event.inputs.hubNetworkType}})
162265

‎.github/workflows/4-policy.yml‎

Lines changed: 110 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,79 @@ defaults:
2323
working-directory: scripts/deployments
2424

2525
jobs:
26-
policy:
27-
name: Policy
26+
Custom_Policy_Definitions:
27+
name: Custom policy definitions
28+
29+
runs-on: ubuntu-latest
30+
steps:
31+
32+
- name: Checkout
33+
uses: actions/checkout@v3
34+
35+
- name: Configure PowerShell modules
36+
run: |
37+
Install-Module Az -Force
38+
Install-Module powershell-yaml -Force
39+
40+
- name: Deploy policy definitions
41+
run: |
42+
./RunWorkflows.ps1 `
43+
-DeployCustomPolicyDefinitions `
44+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
45+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
46+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
47+
-GitHubRef ${env:GITHUB_REF}
48+
49+
Custom_Policy_Set_Definitions:
50+
name: Define custom
51+
needs: Custom_Policy_Definitions
52+
53+
strategy:
54+
matrix:
55+
policySetDefinitionName:
56+
- AKS
57+
- DefenderForCloud
58+
- LogAnalytics
59+
- Network
60+
- DNSPrivateEndpoints
61+
- Tags
62+
fail-fast: false
63+
64+
runs-on: ubuntu-latest
65+
steps:
66+
67+
- name: Checkout
68+
uses: actions/checkout@v3
69+
70+
- name: Configure PowerShell modules
71+
run: |
72+
Install-Module Az -Force
73+
Install-Module powershell-yaml -Force
74+
75+
- name: Deploy policy set definition
76+
run: |
77+
./RunWorkflows.ps1 `
78+
-DeployCustomPolicySetDefinitions `
79+
-CustomPolicySetDefinitionNames '${{ matrix.policySetDefinitionName }}' `
80+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
81+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
82+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
83+
-GitHubRef ${env:GITHUB_REF}
84+
85+
Custom_Policy_Set_Assignments:
86+
name: Assign custom
87+
needs:
88+
- Custom_Policy_Definitions
89+
- Custom_Policy_Set_Definitions
2890

2991
strategy:
3092
matrix:
31-
policyType:
32-
- DeployBuiltInPolicy
33-
- DeployCustomPolicy
93+
policySetAssignmentName:
94+
- AKS
95+
- DefenderForCloud
96+
- LogAnalytics
97+
- Network
98+
- Tags
3499
fail-fast: false
35100

36101
runs-on: ubuntu-latest
@@ -44,11 +109,49 @@ jobs:
44109
Install-Module Az -Force
45110
Install-Module powershell-yaml -Force
46111
47-
- name: Deploy Policy
112+
- name: Deploy policy set assignment
48113
run: |
49114
./RunWorkflows.ps1 `
50-
-${{ matrix.policyType }} `
115+
-DeployCustomPolicySetAssignments `
116+
-CustomPolicySetAssignmentNames '${{ matrix.policySetAssignmentName }}' `
51117
-EnvironmentName '${{github.event.inputs.environmentName}}' `
52118
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
53119
-GitHubRepo ${env:GITHUB_REPOSITORY} `
54120
-GitHubRef ${env:GITHUB_REF}
121+
122+
Builtin_Policy_Set_Assignments:
123+
name: Assign built-in
124+
125+
strategy:
126+
matrix:
127+
policySetAssignmentName:
128+
- asb
129+
- nist80053r4
130+
- nist80053r5
131+
- pbmm
132+
- cis-msft-130
133+
- fedramp-moderate
134+
- hitrust-hipaa
135+
- location
136+
fail-fast: false
137+
138+
runs-on: ubuntu-latest
139+
steps:
140+
141+
- name: Checkout
142+
uses: actions/checkout@v3
143+
144+
- name: Configure PowerShell modules
145+
run: |
146+
Install-Module Az -Force
147+
Install-Module powershell-yaml -Force
148+
149+
- name: Deploy policy set assignment
150+
run: |
151+
./RunWorkflows.ps1 `
152+
-DeployBuiltinPolicySetAssignments `
153+
-BuiltinPolicySetAssignmentNames '${{ matrix.policySetAssignmentName }}' `
154+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
155+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
156+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
157+
-GitHubRef ${env:GITHUB_REF}

‎scripts/deployments/Functions/Policy.ps1‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,8 @@ function Set-PolicySet-Defintions {
6969
$PopulatedParametersFilePath = "$($PolicySetDefinitionsDirectory)/$($policySetDefinitionName)-populated.parameters.json"
7070
$ParametersContent | Set-Content -Path $PopulatedParametersFilePath
7171

72-
Write-Output "Policy Set: $policySetDefinitionName"
72+
Write-Output "Policy set: $policySetDefinitionName"
73+
Write-Output " - Management Group Id: $ManagementGroupId"
7374
Write-Output " - Definition: $PolicySetDefinitionFilePath"
7475
Write-Output " - Parameters: $PolicySetDefinitionParametersFilePath"
7576
Write-Output " - Populated (temp): $PopulatedParametersFilePath"
@@ -114,7 +115,7 @@ function Set-PolicySet-Assignments {
114115
)
115116

116117
foreach ($policySetAssignmentName in $PolicySetAssignmentNames) {
117-
Write-Output "Policy Set assignment Name: $($policySetAssignmentName)"
118+
Write-Output "Policy set assignment name: $($policySetAssignmentName)"
118119

119120
$PolicySetAssignmentFilePath = "$($PolicySetAssignmentsDirectory)/$($policySetAssignmentName).bicep"
120121

@@ -144,6 +145,7 @@ function Set-PolicySet-Assignments {
144145
$ParametersContent | Set-Content -Path $PopulatedParametersFilePath
145146

146147
Write-Output "Policy: $policy"
148+
Write-Output " - Management Group Id: $PolicySetAssignmentManagementGroupId"
147149
Write-Output " - Definition: $PolicySetAssignmentFilePath"
148150
Write-Output " - Parameters: $PolicySetParameterFilePath"
149151
Write-Output " - Populated (temp): $PopulatedParametersFilePath"

0 commit comments

Comments
 (0)