azure_policy_insights_query_results Resource
Use the azure_policy_insights_query_results
InSpec audit resource to test properties and configuration of multiple Azure Policy Insights query results.
Azure REST API Version, Endpoint, and HTTP Client Parameters
This resource interacts with API versions supported by the resource provider.
The api_version
can be defined as a resource parameter.
If not provided, this resource uses the latest version.
For more information, refer to the azure_generic_resource
document.
Unless defined, this resource uses the azure_cloud
global endpoint and default values for the HTTP client.
For more information, refer to the resource pack README.
Install
This resource is available in the Chef InSpec Azure resource pack.
For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.
Syntax
An azure_policy_insights_query_results
resource block returns all policy insights query results, compliant or not, within a subscription.
describe azure_policy_insights_query_results do
it { should exist }
end
Or
describe azure_policy_insights_query_results do
it { should exist }
end
Parameters
This resource does not require any parameters.
Properties
resource_ids
- A list of the unique resource IDs.
Field:
resource_id
policy_assignment_ids
- A list of all policy assignment IDs.
Field:
policyAssignment_id
policy_definition_ids
- A list of all policy definition IDs.
Field:
policyDefinition_id
is_compliant
- A list of boolean flags indicating whether the resource is compliant or not.
Field:
is_compliant
subscription_ids
- A list of subscription IDs.
Field:
subscription_id
resource_types
- A list of resource types.
Field:
resource_type
resource_locations
- A list of resource locations.
Field:
resource_location
resource_groups
- A list of resource group names.
Field:
resource_group
resource_tags
- A list of resource tags.
Field:
resource_tags
policy_assignment_names
- A list of policy assignment names.
Field:
policy_assignment_name
policy_definition_names
- A list of policy definition names.
Field:
policy_definition_name
policy_assignment_scopes
- A list of policy assignment scopes.
Field:
policy_assignment_scope
policy_assignment_parameters
- A list of policy assignment parameters.
Field:
policy_assignment_parameters
policy_definition_actions
- A list of policy definition actions.
Field:
policy_definition_action
policy_definition_categories
- A list of policy definition categories.
Field:
policy_definition_category
management_group_ids
- A list of management group IDs.
Field:
management_group_ids
compliance_states
- A list compliance state of the resource.
Field:
compliance_state
compliance_reason_codes
- A list of reason codes recorded for failure.
Field:
compliance_reason_code
Note
Examples
Check if a specific resource type is present
describe azure_policy_insights_query_results do
its('resource_types') { should include 'Microsoft.VirtualMachineImages/imageTemplates' }
end
Filters the results to include only those Policy Insights query results that have specified location
describe azure_policy_insights_query_results.where(resource_location: 'RESOURCE_LOCATION') do
it { should exist }
end
Filters the results to include only the compliant Policy Insights query results
describe azure_policy_insights_query_results.where(is_compliant: true) do
it { should exist }
its('count') { should be 120 }
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exists
The control passes if the filter returns at least one result. Use should_not
if you expect zero matches.
describe azure_policy_insights_query_results do
it { should exist }
end
Azure Permissions
Your Service Principal must be set up with at least a contributor
role on the subscription you wish to test.