A suite of rules to validate Azure resources and infrastructure as code (IaC) using PSRule.

Features of PSRule for Azure include:

• Ready to go - Leverage over 180 pre-built rules to validate Azure resources.
• DevOps - Validate resources and infrastructure code pre or post-deployment.
• Cross-platform - Run on MacOS, Linux, and Windows.

1. Ready to go:
   • Provide a Azure Well-Architected Framework aligned suite of rules for validating Azure resources.
   • Provide meaningful information to allow remediation.
2. DevOps:
   • Resources and templates can be validated before deployment within DevOps workflows.
   • Allow pull request (PR) validation to prevent invalid configuration being merged.
3. Enterprise ready:
   • Rules can be directly adopted and additional enterprise specific rules can be layed on.
   • Provide regular baselines to allow progressive adoption.

This project uses GitHub Issues to track bugs and feature requests. Please search the existing issues before filing new issues to avoid duplicates.

• For new issues, file your bug or feature request as a new issue.
• For help, discussion, and support questions about using this project, join or start a discussion.

If you have any problems with the PSRule engine, please check the project GitHub issues page instead.

Support for this project/ product is limited to the resources listed above.

This project requires the PSRule and Az PowerShell modules. For details on each see install.

You can download and install these modules from the PowerShell Gallery.

PSRule for Azure provides two methods for analyzing Azure resources:

• Pre-flight - Before resources are deployed from Azure Resource Manager templates.
• In-flight - After resource are deployed to an Azure subscription.

For specific use cases see scenarios. For additional details see the FAQ.

The following example shows how to setup Github Actions to validate templates pre-flight.

1. See Creating a workflow file.
2. Export rule data from templates using PowerShell.
3. Reference Microsoft/ps-rule with modules: 'PSRule.Rules.Azure'.

For example:

# Example: .github/workflows/analyze-arm.yaml

#
# STEP 1: Template validation
#
name: Analyze templates
on:
- pull_request
jobs:
  analyze_arm:
    name: Analyze templates
    runs-on: ubuntu-latest
    steps:

    - name: Checkout
      uses: actions/checkout@v2

    # STEP 2: Export template data for analysis
    - name: Export templates
      run: Install-Module PSRule.Rules.Azure -Force; Get-AzRuleTemplateLink | Export-AzRuleTemplateData -OutputPath 'out/templates/';
      shell: pwsh

    # STEP 3: Run analysis against exported data
    - name: Analyze Azure template files
      uses: Microsoft/ps-rule@main
      with:
        modules: 'PSRule.Rules.Azure'  # Analyze objects using the rules within the PSRule.Rules.Azure PowerShell module.
        inputPath: 'out/templates/'    # Read objects from JSON files in 'out/templates/'.

The following example shows how to setup Azure Pipelines to validate templates pre-flight.

1. Install PSRule extension for Azure DevOps marketplace.
2. Create a new YAML pipeline with the Starter pipeline template.
3. Add the Install PSRule module task.
   • Set module to PSRule.Rules.Azure.
4. Export rule data from templates using PowerShell.
5. Add the PSRule analysis task.
   • Set input type to Input Path.
   • Set input files to the location rule data is exported to.
   • Set modules to PSRule.Rules.Azure.

For example:

# Example: .azure-pipelines/analyze-arm.yaml

#
# STEP 2: Template validation
#
jobs:
- job: 'analyze_arm'
  displayName: 'Analyze templates'
  pool:
    vmImage: 'ubuntu-18.04'
  steps:

  # STEP 3: Install PSRule.Rules.Azure from the PowerShell Gallery
  - task: ps-rule-install@0
    displayName: Install PSRule.Rules.Azure
    inputs:
      module: 'PSRule.Rules.Azure'   # Install PSRule.Rules.Azure from the PowerShell Gallery.

  # STEP 4: Export template data for analysis
  - powershell: Get-AzRuleTemplateLink | Export-AzRuleTemplateData -OutputPath 'out/templates/';
    displayName: 'Export template data'

  # STEP 5: Run analysis against exported data
  - task: ps-rule-assert@0
    displayName: Analyze Azure template files
    inputs:
      inputType: inputPath
      inputPath: 'out/templates/'     # Read objects from JSON files in 'out/templates/'.
      modules: 'PSRule.Rules.Azure'   # Analyze objects using the rules within the PSRule.Rules.Azure PowerShell module.

The following example shows how to setup PSRule locally to validate templates pre-flight.

1. Install the PSRule.Rules.Azure module and dependencies from the PowerShell Gallery.
2. Export rule data from templates using PowerShell.
3. Run analysis against exported data.

For example:

# STEP 1: Install PSRule.Rules.Azure from the PowerShell Gallery
Install-Module -Name 'PSRule.Rules.Azure' -Scope CurrentUser;

# STEP 2: Export template data for analysis
Get-AzRuleTemplateLink | Export-AzRuleTemplateData -OutputPath 'out/templates/';

# STEP 3: Run analysis against exported data
Assert-PSRule -Module 'PSRule.Rules.Azure' -InputPath 'out/templates/';

The following example shows how to setup PSRule locally to validate resources running in a subscription.

1. Install the PSRule.Rules.Azure module and dependencies from the PowerShell Gallery.
2. Connect and set context to an Azure subscription from PowerShell.
3. Export the resource data with the Export-AzRuleData cmdlet.
4. Run analysis against exported data.

For example:

# STEP 1: Install PSRule.Rules.Azure from the PowerShell Gallery
Install-Module -Name 'PSRule.Rules.Azure' -Scope CurrentUser;

# STEP 2: Authenticate to Azure, only required if not currently connected
Connect-AzAccount;

# Confirm the current subscription context
Get-AzContext;

# STEP 3: Exports a resource graph stored as JSON for analysis
Export-AzRuleData -OutputPath 'out/templates/';

# STEP 4: Run analysis against exported data
Assert-PSRule -Module 'PSRule.Rules.Azure' -InputPath 'out/templates/';

By default, resource data for the current subscription context will be exported.

To export resource data for specific subscriptions use:

• -Subscription - to specify subscriptions by id or name.
• -Tenant - to specify subscriptions within an Azure Active Directory Tenant by id.

For example:

# Export data from two specific subscriptions
Export-AzRuleData -Subscription 'Contoso Production', 'Contoso Non-production';

To export specific resource data use:

• -ResourceGroupName - to filter resources by Resource Group.
• -Tag - to filter resources based on tag.

For example:

# Export information from two resource groups within the current subscription context
Export-AzRuleData -ResourceGroupName 'rg-app1-web', 'rg-app1-db';

To export resource data for all subscription contexts use:

• -All - to export resource data for all subscription contexts.

For example:

# Export data from all subscription contexts
Export-AzRuleData -All;

To filter results to only failed rules, use Invoke-PSRule -Outcome Fail. Passed, failed and error results are shown by default.

For example:

# Only show failed results
Invoke-PSRule -InputPath 'out/templates/' -Module 'PSRule.Rules.Azure' -Outcome Fail;

The output of this example is:

   TargetName: storage

RuleName                            Outcome    Recommendation
--------                            -------    --------------
Azure.Storage.UseReplication        Fail       Storage accounts not using GRS may be at risk
Azure.Storage.SecureTransferRequ... Fail       Storage accounts should only accept secure traffic
Azure.Storage.SoftDelete            Fail       Enable soft delete on Storage Accounts

A summary of results can be displayed by using Invoke-PSRule -As Summary.

For example:

# Display as summary results
Invoke-PSRule -InputPath 'out/templates/' -Module 'PSRule.Rules.Azure' -As Summary;

The output of this example is:

RuleName                            Pass  Fail  Outcome
--------                            ----  ----  -------
Azure.ACR.MinSku                    0     1     Fail
Azure.AppService.PlanInstanceCount  0     1     Fail
Azure.AppService.UseHTTPS           0     2     Fail
Azure.Resource.UseTags              73    36    Fail
Azure.SQL.ThreatDetection           0     1     Fail
Azure.SQL.Auditing                  0     1     Fail
Azure.Storage.UseReplication        1     7     Fail
Azure.Storage.SecureTransferRequ... 2     6     Fail
Azure.Storage.SoftDelete            0     8     Fail

For walk through examples of PSRule.Rules.Azure module usage see:

• Validate Azure resources from templates with Azure Pipelines
• Validate Azure resources from templates with continuous integration (CI)

PSRule for Azure includes rules across five pillars of the Microsoft Azure Well-Architected Framework.

• Rules for architecture excellence
  • Cost Optimization
  • Operational Excellence
  • Performance Efficiency
  • Reliability
  • Security

To view a list of rules by Azure resources see:

• Rules by resource

The following baselines are included within PSRule.Rules.Azure.

• Azure.Default - Default baseline for Azure rules.
• Azure.Preview - Includes Azure features in preview.
• Azure.All - Includes all Azure rules.
• Azure.GA_2020_06 - Baseline for GA rules released June 2020 or prior.
• Azure.GA_2020_09 - Baseline for GA rules released September 2020 or prior.
• Azure.GA_2020_12 - Baseline for GA rules released December 2020 or prior.

PSRule for Azure extends PowerShell with the following cmdlets.

The following commands exist in the PSRule.Rules.Azure module:

• Export-AzRuleData - Export resource configuration data from Azure subscriptions.
• Export-AzRuleTemplateData - Export resource configuration data from Azure templates.
• Get-AzRuleTemplateLink - Get a metadata link to a Azure template file.

The following conceptual topics exist in the PSRule.Rules.Azure module:

• Azure metadata link
• Configuration
  • Azure_AKSMinimumVersion
  • Azure_AKSNodeMinimumMaxPods
  • Azure_AllowedRegions
  • Azure_MinimumCertificateLifetime
  • AZURE_RESOURCE_GROUP
  • AZURE_SUBSCRIPTION

The following projects can also be used with PSRule for Azure.

Modules in this repository will use the semantic versioning model to declare breaking changes from v1.0.0. Prior to v1.0.0, breaking changes may be introduced in minor (0.x.0) version increments. For a list of module changes please see the change log.

Pre-release module versions are created on major commits and can be installed from the PowerShell Gallery. Pre-release versions should be considered experimental. Modules and change log details for pre-releases will be removed as standard releases are made available.

This project welcomes contributions and suggestions. If you are ready to contribute, please visit the contribution guide.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

• Bernie White

This project is licensed under the MIT License.