azure_policy_insights_query

Use the azure_policy_insights_query_results InSpec audit resource to test properties and configuration of multiple Azure Policy Insights query results.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Install

This resource is available in the Chef InSpec Azure resource pack.

For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.

Syntax

An azure_policy_insights_query_results resource block returns all policy insights query results, compliant or not, within a subscription.

describe azure_policy_insights_query_results do
  it { should exist }
end

describe azure_policy_insights_query_results do
  it { should exist }
end

Parameters

This resource does not require any parameters.

Properties

resource_ids: A list of the unique resource IDs.; Field: resource_id
policy_assignment_ids: A list of all policy assignment IDs.; Field: policyAssignment_id
policy_definition_ids: A list of all policy definition IDs.; Field: policyDefinition_id
is_compliant: A list of boolean flags indicating whether the resource is compliant or not.; Field: is_compliant
subscription_ids: A list of subscription IDs.; Field: subscription_id
resource_types: A list of resource types.; Field: resource_type
resource_locations: A list of resource locations.; Field: resource_location
resource_groups: A list of resource group names.; Field: resource_group
resource_tags: A list of resource tags.; Field: resource_tags
policy_assignment_names: A list of policy assignment names.; Field: policy_assignment_name
policy_definition_names: A list of policy definition names.; Field: policy_definition_name
policy_assignment_scopes: A list of policy assignment scopes.; Field: policy_assignment_scope
policy_assignment_parameters: A list of policy assignment parameters.; Field: policy_assignment_parameters
policy_definition_actions: A list of policy definition actions.; Field: policy_definition_action
policy_definition_categories: A list of policy definition categories.; Field: policy_definition_category
management_group_ids: A list of management group IDs.; Field: management_group_ids
compliance_states: A list compliance state of the resource.; Field: compliance_state
compliance_reason_codes: A list of reason codes recorded for failure.; Field: compliance_reason_code

Note

For information on using filter criteria on plural resources, see the documentation on FilterTable

Examples

Check if a specific resource type is present

describe azure_policy_insights_query_results do
  its('resource_types')  { should include 'Microsoft.VirtualMachineImages/imageTemplates' }
end

Filters the results to include only those Policy Insights query results that have specified location

describe azure_policy_insights_query_results.where(resource_location: 'RESOURCE_LOCATION') do
  it { should exist }
end

Filters the results to include only the compliant Policy Insights query results

describe azure_policy_insights_query_results.where(is_compliant: true) do
  it { should exist }
  its('count') { should be 120  }
end

Matchers

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

exists

The control passes if the filter returns at least one result. Use should_not if you expect zero matches.

describe azure_policy_insights_query_results do
  it { should exist }
end

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.

azure_policy_insights_query_results Resource