[Modules] Policy assignment updated nonCompliance messages (#1644)

Azure · Jul 8, 2022 · fa8d770 · fa8d770
1 parent e46939e
commit fa8d770
Show file tree

Hide file tree

Showing 12 changed files with 77 additions and 42 deletions.
diff --git a/.lycheeignore b/.lycheeignore
@@ -1,10 +1,21 @@
 https://foo.psd1/
-file:///github
+https://teststringforvalidation.com/
+http://localhost/
 https://mystorageaccount.blob.core.windows.net
 https://mykeyvault.vault.azure.net
 https://www.powershellgallery.com
 https://github.com/myProject
 http://validurltoconfiglocation/
 https://mycustomdependencylocation/
 http://tools.ietf.org/html/rfc6749#section-3.2
+https://adp-/
+https://www.contoso.com/webhook
+https://adp/
+file:///github
+dummy@contoso.com
+test2@contoso.com
+test1@contoso.com
+test@contoso.com
+foo@contoso.com
 @parameters.json
+'@odata.type
diff --git a/modules/Microsoft.Authorization/policyAssignments/.test/mg.parameters.json b/modules/Microsoft.Authorization/policyAssignments/.test/mg.parameters.json
@@ -24,8 +24,12 @@
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"

diff --git a/modules/Microsoft.Authorization/policyAssignments/.test/rg.parameters.json b/modules/Microsoft.Authorization/policyAssignments/.test/rg.parameters.json
@@ -24,8 +24,12 @@
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"

diff --git a/modules/Microsoft.Authorization/policyAssignments/.test/sub.parameters.json b/modules/Microsoft.Authorization/policyAssignments/.test/sub.parameters.json
@@ -24,8 +24,12 @@
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"

diff --git a/modules/Microsoft.Authorization/policyAssignments/deploy.bicep b/modules/Microsoft.Authorization/policyAssignments/deploy.bicep
@@ -34,7 +34,7 @@ param roleDefinitionIds array = []
 param metadata object = {}
 
 @sys.description('Optional. The messages that describe why a resource is non-compliant with the policy.')
-param nonComplianceMessage string = ''
+param nonComplianceMessages array = []
 
 @sys.description('Optional. The policy assignment enforcement mode. Possible values are Default and DoNotEnforce. - Default or DoNotEnforce.')
 @allowed([
@@ -89,7 +89,7 @@ module policyAssignment_mg 'managementGroup/deploy.bicep' = if (empty(subscripti
     userAssignedIdentityId: userAssignedIdentityId
     roleDefinitionIds: !empty(roleDefinitionIds) ? roleDefinitionIds : []
     metadata: !empty(metadata) ? metadata : {}
-    nonComplianceMessage: !empty(nonComplianceMessage) ? nonComplianceMessage : ''
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
     managementGroupId: managementGroupId
@@ -111,7 +111,7 @@ module policyAssignment_sub 'subscription/deploy.bicep' = if (!empty(subscriptio
     userAssignedIdentityId: userAssignedIdentityId
     roleDefinitionIds: !empty(roleDefinitionIds) ? roleDefinitionIds : []
     metadata: !empty(metadata) ? metadata : {}
-    nonComplianceMessage: !empty(nonComplianceMessage) ? nonComplianceMessage : ''
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
     subscriptionId: subscriptionId
@@ -133,7 +133,7 @@ module policyAssignment_rg 'resourceGroup/deploy.bicep' = if (!empty(resourceGro
     userAssignedIdentityId: userAssignedIdentityId
     roleDefinitionIds: !empty(roleDefinitionIds) ? roleDefinitionIds : []
     metadata: !empty(metadata) ? metadata : {}
-    nonComplianceMessage: !empty(nonComplianceMessage) ? nonComplianceMessage : ''
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
     subscriptionId: subscriptionId

diff --git a/modules/Microsoft.Authorization/policyAssignments/managementGroup/deploy.bicep b/modules/Microsoft.Authorization/policyAssignments/managementGroup/deploy.bicep
@@ -35,7 +35,7 @@ param roleDefinitionIds array = []
 param metadata object = {}
 
 @sys.description('Optional. The messages that describe why a resource is non-compliant with the policy.')
-param nonComplianceMessage string = ''
+param nonComplianceMessages array = []
 
 @sys.description('Optional. The policy assignment enforcement mode. Possible values are Default and DoNotEnforce. - Default or DoNotEnforce.')
 @allowed([
@@ -53,10 +53,6 @@ param notScopes array = []
 @sys.description('Optional. Location for all resources.')
 param location string = deployment().location
 
-var nonComplianceMessage_var = {
-  message: !empty(nonComplianceMessage) ? nonComplianceMessage : null
-}
-
 @sys.description('Optional. Enable telemetry via the Customer Usage Attribution ID (GUID).')
 param enableDefaultTelemetry bool = true
 
@@ -91,7 +87,7 @@ resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01'
     description: !empty(description) ? description : null
     policyDefinitionId: policyDefinitionId
     parameters: parameters
-    nonComplianceMessages: !empty(nonComplianceMessage) ? array(nonComplianceMessage_var) : []
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
   }

diff --git a/modules/Microsoft.Authorization/policyAssignments/managementGroup/readme.md b/modules/Microsoft.Authorization/policyAssignments/managementGroup/readme.md
@@ -35,7 +35,7 @@ With this module you can perform policy assignments on a management group level.
 | `location` | string | `[deployment().location]` |  | Location for all resources. |
 | `managementGroupId` | string | `[managementGroup().name]` |  | The Target Scope for the Policy. The name of the management group for the policy assignment. If not provided, will use the current scope for deployment. |
 | `metadata` | object | `{object}` |  | The policy assignment metadata. Metadata is an open ended object and is typically a collection of key-value pairs. |
-| `nonComplianceMessage` | string | `''` |  | The messages that describe why a resource is non-compliant with the policy. |
+| `nonComplianceMessages` | array | `[]` |  | The messages that describe why a resource is non-compliant with the policy. |
 | `notScopes` | array | `[]` |  | The policy excluded scopes. |
 | `parameters` | object | `{object}` |  | Parameters for the policy assignment if needed. |
 | `userAssignedIdentityId` | string | `''` |  | The Resource ID for the user assigned identity to assign to the policy assignment. |

diff --git a/modules/Microsoft.Authorization/policyAssignments/readme.md b/modules/Microsoft.Authorization/policyAssignments/readme.md
@@ -37,7 +37,7 @@ With this module you can perform policy assignments across the management group,
 | `location` | string | `[deployment().location]` |  | Location for all resources. |
 | `managementGroupId` | string | `[managementGroup().name]` |  | The Target Scope for the Policy. The name of the management group for the policy assignment. If not provided, will use the current scope for deployment. |
 | `metadata` | object | `{object}` |  | The policy assignment metadata. Metadata is an open ended object and is typically a collection of key-value pairs. |
-| `nonComplianceMessage` | string | `''` |  | The messages that describe why a resource is non-compliant with the policy. |
+| `nonComplianceMessages` | array | `[]` |  | The messages that describe why a resource is non-compliant with the policy. |
 | `notScopes` | array | `[]` |  | The policy excluded scopes. |
 | `parameters` | object | `{object}` |  | Parameters for the policy assignment if needed. |
 | `resourceGroupName` | string | `''` |  | The Target Scope for the Policy. The name of the resource group for the policy assignment. |
@@ -241,8 +241,12 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"
@@ -298,7 +302,11 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
         value: 'prod'
       }
     }
-    nonComplianceMessage: 'Violated Policy Assignment - This is a Non Compliance Message'
+    nonComplianceMessages: [
+      {
+        message: 'Violated Policy Assignment - This is a Non Compliance Message'
+      }
+    ]
     enforcementMode: 'DoNotEnforce'
     metadata: {
       category: 'Security'
@@ -401,8 +409,12 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"
@@ -464,7 +476,11 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
         value: 'prod'
       }
     }
-    nonComplianceMessage: 'Violated Policy Assignment - This is a Non Compliance Message'
+    nonComplianceMessages: [
+      {
+        message: 'Violated Policy Assignment - This is a Non Compliance Message'
+      }
+    ]
     enforcementMode: 'DoNotEnforce'
     metadata: {
       category: 'Security'
@@ -565,8 +581,12 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
                 }
             }
         },
-        "nonComplianceMessage": {
-            "value": "Violated Policy Assignment - This is a Non Compliance Message"
+        "nonComplianceMessages": {
+            "value": [
+                {
+                    "message": "Violated Policy Assignment - This is a Non Compliance Message"
+                }
+            ]
         },
         "enforcementMode": {
             "value": "DoNotEnforce"
@@ -625,7 +645,11 @@ module policyAssignments './Microsoft.Authorization/policyAssignments/deploy.bic
         value: 'prod'
       }
     }
-    nonComplianceMessage: 'Violated Policy Assignment - This is a Non Compliance Message'
+    nonComplianceMessages: [
+      {
+        message: 'Violated Policy Assignment - This is a Non Compliance Message'
+      }
+    ]
     enforcementMode: 'DoNotEnforce'
     metadata: {
       category: 'Security'

diff --git a/modules/Microsoft.Authorization/policyAssignments/resourceGroup/deploy.bicep b/modules/Microsoft.Authorization/policyAssignments/resourceGroup/deploy.bicep
@@ -35,7 +35,7 @@ param roleDefinitionIds array = []
 param metadata object = {}
 
 @sys.description('Optional. The messages that describe why a resource is non-compliant with the policy.')
-param nonComplianceMessage string = ''
+param nonComplianceMessages array = []
 
 @sys.description('Optional. The policy assignment enforcement mode. Possible values are Default and DoNotEnforce. - Default or DoNotEnforce.')
 @allowed([
@@ -50,10 +50,6 @@ param notScopes array = []
 @sys.description('Optional. Location for all resources.')
 param location string = resourceGroup().location
 
-var nonComplianceMessage_var = {
-  message: !empty(nonComplianceMessage) ? nonComplianceMessage : null
-}
-
 @sys.description('Optional. The Target Scope for the Policy. The subscription ID of the subscription for the policy assignment. If not provided, will use the current scope for deployment.')
 param subscriptionId string = subscription().subscriptionId
 
@@ -93,7 +89,7 @@ resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01'
     description: !empty(description) ? description : null
     policyDefinitionId: policyDefinitionId
     parameters: parameters
-    nonComplianceMessages: !empty(nonComplianceMessage) ? array(nonComplianceMessage_var) : []
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
   }

diff --git a/modules/Microsoft.Authorization/policyAssignments/resourceGroup/readme.md b/modules/Microsoft.Authorization/policyAssignments/resourceGroup/readme.md
@@ -34,7 +34,7 @@ With this module you can perform policy assignments on a resource group level
 | `identity` | string | `'SystemAssigned'` | `[SystemAssigned, UserAssigned, None]` | The managed identity associated with the policy assignment. Policy assignments must include a resource identity when assigning 'Modify' policy definitions. |
 | `location` | string | `[resourceGroup().location]` |  | Location for all resources. |
 | `metadata` | object | `{object}` |  | The policy assignment metadata. Metadata is an open ended object and is typically a collection of key-value pairs. |
-| `nonComplianceMessage` | string | `''` |  | The messages that describe why a resource is non-compliant with the policy. |
+| `nonComplianceMessages` | array | `[]` |  | The messages that describe why a resource is non-compliant with the policy. |
 | `notScopes` | array | `[]` |  | The policy excluded scopes. |
 | `parameters` | object | `{object}` |  | Parameters for the policy assignment if needed. |
 | `resourceGroupName` | string | `[resourceGroup().name]` |  | The Target Scope for the Policy. The name of the resource group for the policy assignment. If not provided, will use the current scope for deployment. |

diff --git a/modules/Microsoft.Authorization/policyAssignments/subscription/deploy.bicep b/modules/Microsoft.Authorization/policyAssignments/subscription/deploy.bicep
@@ -35,7 +35,7 @@ param roleDefinitionIds array = []
 param metadata object = {}
 
 @sys.description('Optional. The messages that describe why a resource is non-compliant with the policy.')
-param nonComplianceMessage string = ''
+param nonComplianceMessages array = []
 
 @sys.description('Optional. The policy assignment enforcement mode. Possible values are Default and DoNotEnforce. - Default or DoNotEnforce.')
 @allowed([
@@ -50,10 +50,6 @@ param notScopes array = []
 @sys.description('Optional. Location for all resources.')
 param location string = deployment().location
 
-var nonComplianceMessage_var = {
-  message: !empty(nonComplianceMessage) ? nonComplianceMessage : null
-}
-
 @sys.description('Optional. The Target Scope for the Policy. The subscription ID of the subscription for the policy assignment. If not provided, will use the current scope for deployment.')
 param subscriptionId string = subscription().subscriptionId
 
@@ -91,7 +87,7 @@ resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01'
     description: !empty(description) ? description : null
     policyDefinitionId: policyDefinitionId
     parameters: parameters
-    nonComplianceMessages: !empty(nonComplianceMessage) ? array(nonComplianceMessage_var) : []
+    nonComplianceMessages: !empty(nonComplianceMessages) ? nonComplianceMessages : []
     enforcementMode: enforcementMode
     notScopes: !empty(notScopes) ? notScopes : []
   }

diff --git a/modules/Microsoft.Authorization/policyAssignments/subscription/readme.md b/modules/Microsoft.Authorization/policyAssignments/subscription/readme.md
@@ -34,7 +34,7 @@ With this module you can perform policy assignments on a subscription level.
 | `identity` | string | `'SystemAssigned'` | `[SystemAssigned, UserAssigned, None]` | The managed identity associated with the policy assignment. Policy assignments must include a resource identity when assigning 'Modify' policy definitions. |
 | `location` | string | `[deployment().location]` |  | Location for all resources. |
 | `metadata` | object | `{object}` |  | The policy assignment metadata. Metadata is an open ended object and is typically a collection of key-value pairs. |
-| `nonComplianceMessage` | string | `''` |  | The messages that describe why a resource is non-compliant with the policy. |
+| `nonComplianceMessages` | array | `[]` |  | The messages that describe why a resource is non-compliant with the policy. |
 | `notScopes` | array | `[]` |  | The policy excluded scopes. |
 | `parameters` | object | `{object}` |  | Parameters for the policy assignment if needed. |
 | `subscriptionId` | string | `[subscription().subscriptionId]` |  | The Target Scope for the Policy. The subscription ID of the subscription for the policy assignment. If not provided, will use the current scope for deployment. |