Repository files navigation

A suite of rules to validate Azure resources against the Cloud Adoption Framework (CAF) using PSRule.

Features of PSRule for CAF include:

• Ready to go - Leverage configurable rules to validate Azure resources.
• DevOps - Validate resources and infrastructure code pre or post-deployment.
• Cross-platform - Run on MacOS, Linux, and Windows.

This project requires thePSRule,PSRule.Rules.Azure andAz PowerShell modules.For details on each seeinstall.

You can download and install these modules from the PowerShell Gallery.

PSRule for CAF provides two methods for analyzing Azure resources:

• Pre-flight - Before resources are deployed from Azure Resource Manager (ARM) templates.
• In-flight - After resource are deployed to an Azure subscription.

For additional details see theFAQ.

The following example shows how to setup Github Actions to validate templates pre-flight.

1. SeeCreating a workflow file.
2. Referencemicrosoft/ps-rule withmodules: 'PSRule.Rules.CAF'.
3. Create and configureps-rule.yaml in the repository root directory.

Example workflow:

# Example: .github/workflows/analyze-arm.yaml## STEP 1: Template validation#name:Analyze templateson:-pull_requestjobs:analyze_arm:name:Analyze templatesruns-on:ubuntu-lateststeps:    -name:Checkoutuses:actions/checkout@v3# STEP 3: Run analysis against PSRule for Cloud Adoption Framework    -name:Test Azure Infrastructure as Codeuses:microsoft/ps-rule@v2.0.0with:modules:'PSRule.Rules.CAF'

Example PSRule options:

# Example: ps-rule.yaml## PSRule configuration## Please see the documentation for all configuration options:# https://aka.ms/ps-rule/optionsinclude:module:  -PSRule.Rules.CAFrequires:PSRule.Rules.CAF:'>=0.3.0'output:culture:  -en-USconfiguration:# Enable expansion for Bicep source files.AZURE_BICEP_FILE_EXPANSION:true# Enable expansion for template expansion.AZURE_PARAMETER_FILE_EXPANSION:true

The following example shows how to setup Azure Pipelines to validate templates pre-flight.

1. InstallPSRule extension for Azure DevOps marketplace.
2. Create a new YAML pipeline with theStarter pipeline template.
3. Add thePSRule analysis task.
   • Setmodules toPSRule.Rules.CAF.
4. Create and configureps-rule.yaml in the repository root directory.

Example pipeline:

# Example: .pipelines/analyze-arm.yaml## STEP 2: Template validation#jobs:-job:'analyze_arm'displayName:'Analyze templates'pool:vmImage:'ubuntu-20.04'steps:# STEP 3: Run analysis against PSRule for Cloud Adoption Framework  -task:ps-rule-assert@1displayName:Test Azure Infrastructure as Codeinputs:modules:'PSRule.Rules.CAF'

Example PSRule options:

# Example: ps-rule.yaml## PSRule configuration## Please see the documentation for all configuration options:# https://aka.ms/ps-rule/optionsinclude:module:  -PSRule.Rules.CAFrequires:PSRule.Rules.CAF:'>=0.3.0'output:culture:  -en-USconfiguration:# Enable expansion for Bicep source files.AZURE_BICEP_FILE_EXPANSION:true# Enable expansion for template expansion.AZURE_PARAMETER_FILE_EXPANSION:true

The following example shows how to setup PSRule locally to validate templates pre-flight.

1. Install thePSRule.Rules.CAF module and dependencies from the PowerShell Gallery.
2. Create and configureps-rule.yaml in the repository root directory.
3. Run analysis against PSRule for Cloud Adoption Framework.

Example install command-line:

# STEP 1: Install from the PowerShell GalleryInstall-Module-Name'PSRule.Rules.CAF'-Scope CurrentUser-Repository PSGallery;

Example PSRule options:

# Example: ps-rule.yaml## PSRule configuration## Please see the documentation for all configuration options:# https://aka.ms/ps-rule/optionsinclude:module:  -PSRule.Rules.CAFrequires:PSRule.Rules.CAF:'>=0.3.0'output:culture:  -en-USconfiguration:# Enable expansion for Bicep source files.AZURE_BICEP_FILE_EXPANSION:true# Enable expansion for template expansion.AZURE_PARAMETER_FILE_EXPANSION:true

Example test command-line:

# STEP 3: Test Azure Infrastructure as CodeAssert-PSRule-Module'PSRule.Rules.CAF'-Format File-InputPath'.';

A number of issues can occur when expanding Azure templates or Bicep source files.Or you may not get any results at all if expansion is not configured.See the following topics:

• Expanding source files - limitations
• Using template
• Using Bicep source

The following example shows how to setup PSRule locally to validate resources running in a subscription.

1. Install thePSRule.Rules.CAF module and dependencies from the PowerShell Gallery.
2. Connect and set context to an Azure subscription from PowerShell.
3. Export the resource data with theExport-AzRuleData cmdlet.
4. Run analysis against exported data.

For example:

# STEP 1: Install PSRule.Rules.CAF from the PowerShell GalleryInstall-Module-Name'PSRule.Rules.CAF'-Scope CurrentUser;# STEP 2: Authenticate to Azure, only required if not currently connectedConnect-AzAccount;# Confirm the current subscription contextGet-AzContext;# STEP 3: Exports a resource graph stored as JSON for analysisExport-AzRuleData-OutputPath'out/templates/';# STEP 4: Run analysis against exported dataAssert-PSRule-Module'PSRule.Rules.CAF'-InputPath'out/templates/';

For a list of rules included in thePSRule.Rules.CAF module see:

• Module rule reference

Rules included in this module define a number of configurable values that can be set on an as need basis.By default these values use the standards defined by the CAF.A list of configurable values are included in the reference for each rule.

This module uses commands from thePSRule.Rules.Azure module to export resource configuration data.ThePSRule.Rules.Azure module is included as a dependency ofPSRule.Rules.CAF.

For details ofPSRule.Rules.Azure commands see:

• Export-AzRuleData - Export resource configuration data from Azure subscriptions.
• Export-AzTemplateRuleData - Export resource configuration data from Azure templates.

Modules in this repository will use thesemantic versioning model to declare breaking changes from v1.0.0.Prior to v1.0.0, breaking changes may be introduced in minor (0.x.0) version increments.For a list of module changes please see thechange log.

Pre-release module versions are created on major commits and can be installed from the PowerShell Gallery.Pre-release versions should be considered experimental.Modules and change log details for pre-releases will be removed as standard releases are made available.

This project has adopted theMicrosoft Open Source Code of Conduct.For more information see theCode of Conduct FAQor contactopencode@microsoft.com with any additional questions or comments.

• Bernie White

This project islicensed under the MIT License.