Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes to export script #866

Merged
merged 1 commit into from
Feb 2, 2025
Merged

Fixes to export script #866

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions Docs/operational-scripts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,9 @@ The Hydration Kit is a set of scripts that can be used to deploy an EPAC environ

The scripts `New-AzureDevOpsBug` and `New-GitHubIssue` create a Bug or Issue when there are one or multiple failed Remediation Tasks.

## Export from AzAdvertizer
## Export Policy To EPAC

The script `Export-PolicyToEPAC.ps1` creates for you the policyAssignments, policyDefinitions, and policySetDefinitions based on the provided URL in an Output folder under 'ALZ-Export'.
The script `Export-PolicyToEPAC.ps1` creates for you the policyAssignments, policyDefinitions, and policySetDefinitions based on the provided definition/set ID into an Output folder under 'Export'.

Parameters:

Expand All @@ -56,9 +56,11 @@ Parameters:

* **UseBuiltIn**: Default to using builtin policies rather than local versions.

* **Scope**: Used to set scope value on each assignment file.
* **PacSelector**: Used to set PacEnvironment for each assignment file based on the pac selector privided. This pulls from global-settings.jsonc, therefore it must exist or an erro will be thrown.

* **PacSelector**: Used to set PacEnvironment for each assignment file.
* **OverwriteScope**: Used to overwrite scope value on each assignment file.

* **OverwritePacSelector**: Used to overwrite PacEnvironment for each assignment file.

* **OverwriteOutput**: Used to Overwrite the contents of the output folder with each run. Helpful when running consecutively.

Expand Down
22 changes: 22 additions & 0 deletions Scripts/Helpers/Confirm-ObjectValueEqualityDeep.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,31 @@ function Confirm-ObjectValueEqualityDeep {
# $Object1 or $Object2 is an array or ArrayList
if ($Object1 -isnot [System.Collections.Ilist]) {
$Object1 = @($Object1)
# This resolves a unique situation where GraphApi returns a string instead of an array for a metadata value, very unique situation
# By testing the json and count, we can confirm that it is a json string and convert it to an array
# A try catch is included to revert to the value we normally use in the event of failure just in case there is a scenario that has not been accounted for
if ($(Test-Json -InputObject $Object1) -and $Object1.count -eq 1) {
try {
$Object1 = $Object1 | ConvertFrom-Json -Depth 100
}
catch {
$Object1 = @($Object1)
}
}
}
elseif ($Object2 -isnot [System.Collections.Ilist]) {
$Object2 = @($Object2)
# This resolves a unique situation where GraphApi returns a string instead of an array for a metadata value, very unique situation
# By testing the json and count, we can confirm that it is a json string and convert it to an array
# A try catch is included to revert to the value we normally use in the event of failure just in case there is a scenario that has not been accounted for
if ($(Test-Json -InputObject $Object2) -and $Object2.count -eq 1) {
try {
$Object2 = $Object2 | ConvertFrom-Json -Depth 100
}
catch {
$Object2 = @($Object2)
}
}
}
if ($Object1.Count -ne $Object2.Count) {
return $false
Expand Down
66 changes: 52 additions & 14 deletions Scripts/Operations/Export-PolicyToEPAC.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,13 @@
.PARAMETER UseBuiltIn
Default to using builtin policies rather than local versions.

.PARAMETER Scope
.PARAMETER PacSelector
Used to set scope value on each assignment file.

.PARAMETER PacSelector
.PARAMETER OverwriteScope
Used to set scope value on each assignment file.

.PARAMETER OverwritePacSelector
Used to set PacEnvironment for each assignment file.

.PARAMETER OverwriteOutput
Expand All @@ -37,7 +40,7 @@
Retrieves Policy from Azure Portal, auto creates parameters to be manipulated in the assignment and sets assignment and policy set to use built-in policies rather than self hosted.

.EXAMPLE
"./Export-PolicyToEPAC.ps1" -ALZPolicySetDefinitionId "Enforce-Guardrails-OpenAI" -PacSelector "EPAC-Prod" -Scope "/providers/Microsoft.Management/managementGroups/4fb849a3-3ff3-4362-af8e-45174cd753dd"
"./Export-PolicyToEPAC.ps1" -ALZPolicySetDefinitionId "Enforce-Guardrails-OpenAI" -PacSelector "EPAC-Prod" -OverwriteScope "/providers/Microsoft.Management/managementGroups/4fb849a3-3ff3-4362-af8e-45174cd753dd"
Retrieves Policy from ALZ Repo, sets the PacSelector in the assignment files to "EPAC-Prod" and the scope to the management group path provided.
#>

Expand Down Expand Up @@ -65,10 +68,13 @@ param (
[bool] $UseBuiltIn = $true,

[Parameter(Mandatory = $false, HelpMessage = "Used to set scope value on each assignment file")]
[string] $Scope,
[string] $PacSelector,

[Parameter(Mandatory = $false, HelpMessage = "Used to set scope value on each assignment file")]
[string] $OverwriteScope,

[Parameter(Mandatory = $false, HelpMessage = "Used to set PacEnvironment for each assignment file")]
[string] $PacSelector,
[string] $OverwritePacSelector,

[Parameter(Mandatory = $false, HelpMessage = "Used to Overwrite the contents of the output folder with each run. Helpful when running consecutively")]
[bool] $OverwriteOutput = $true
Expand Down Expand Up @@ -651,6 +657,7 @@ elseif ($ALZPolicySetDefinitionId) {
}
else {
Write-Error "Export-PolicyToEPAC requires at least one of the following: PolicyDefinitionId, PolicySetDefinitionId, ALZPolicyDefinitionId or ALZPolicySetDefinitionId!"
exit 1
}


Expand Down Expand Up @@ -719,20 +726,51 @@ if ($policyObject) {
$assignmentObject.children.assignment.displayName = "$policyDisplayName"
$assignmentObject.children.assignment.description = "$policyDescription"

# Overwrite PacSelector is given
if ($PacSelector -and $PacSelector -ne "EPAC-Dev") {
$assignmentObject.children.scope | Add-Member -MemberType NoteProperty -Name "$PacSelector" -Value ""
$assignmentObject.children.scope.$PacSelector = $assignmentObject.children.scope.'EPAC-Dev'
# Set PacSelector from Global-Settings if given
if ($PacSelector) {
$filePath = "Definitions/global-settings.jsonc"
if (Test-Path -Path $filePath) {
$globalSettingsContent = Get-Content -Path $filePath | ConvertFrom-Json
}
else {
Write-Error "'global-settings.jconc' file found in the 'Definitions' folder."
exit 1
}
$pacEnvironments = $globalSettingsContent.PacEnvironments
if ($pacEnvironments.pacSelector -contains "$PacSelector") {
foreach ($environment in $pacEnvironments) {
if ($environment.pacSelector -eq "$PacSelector") {
$tempScope = $environment.deploymentRootScope
$assignmentObject.children.scope | Add-Member -MemberType NoteProperty -Name "$PacSelector" -Value @("$tempScope")
$assignmentObject.children[0].nodeName = "$PacSelector"
$assignmentObject.children.scope.PSObject.Properties.Remove("EPAC-Dev")
}
}
}
else {
Write-Error "The PacSelector provided not found in 'global-settings.jconc' file."
exit 1
}

# Overwrite Scope if given
if ($OverwriteScope) {
$assignmentObject.children[0].scope.$PacSelector[0] = "$OverwriteScope"
}
}

# Overwrite PacSelector if given
if ($OverwritePacSelector -and $OverwritePacSelector -ne "EPAC-Dev") {
$assignmentObject.children.scope | Add-Member -MemberType NoteProperty -Name "$OverwritePacSelector" -Value ""
$assignmentObject.children.scope.$OverwritePacSelector = $assignmentObject.children.scope.'EPAC-Dev'
$assignmentObject.children.scope.PSObject.Properties.Remove("EPAC-Dev")
}

# Overwrite Scope if given
if ($Scope -and $PacSelector) {
$assignmentObject.children.scope.$PacSelector = "$Scope"
if ($OverwriteScope -and $OverwritePacSelector -and !$PacSelector) {
$assignmentObject.children.scope.$OverwritePacSelector[0] = "$OverwriteScope"
}
elseif ($Scope -and !$PacSelector) {
$assignmentObject.children.scope.'EPAC-Dev' = "$Scope"

elseif ($OverwriteScope -and !$OverwritePacSelector -and !$PacSelector) {
$assignmentObject.children.scope.'EPAC-Dev'[0] = "$OverwriteScope"
}

#region AutoParameter
Expand Down