Skip to content

policy-definitions.md

Latest commit

 

History

History
80 lines (49 loc) · 4.64 KB

policy-definitions.md

File metadata and controls

80 lines (49 loc) · 4.64 KB

GitHub Actions Workflow for Azure Policy Definitions

1. Overview

The Policy Definitions GitHub Actions Workflow deploys all required custom policy definitions to the target Azure environments.

Policy Definitions Workflow

The workflow consists of the following jobs:

  • Initiation
  • Policy Tests
  • Build Dev
  • Build Prod
  • Test Dev
  • Test Prod
  • Deploy Dev
  • Deploy Prod
  1. After the Initiation job, the Policy Tests job performs a number of predefined Pester tests for each policy definition file that are to be deployed.
  2. The Build Dev and Build Prod jobs are kicked off concurrently upon the successful completion of the Policy Tests job. These jobs are responsible for building the policy definition Bicep template for the development and production environments respectively.
  3. The Test Dev and Test Prod jobs are responsible for performing additional tests in their respective environments. They are kicked off after the Build Dev and Build Prod jobs respectively.
  4. The Deploy Dev job is kicked off upon successful completion of the Test Dev job. It is responsible for deploying the policy definitions to the development environment.
  5. The Deploy Prod job will only be kicked off when all the following conditions are met:
    • The Deploy Dev job has completed successfully.
    • The Test Prod job has completed successfully.
    • The workflow is triggered from the main branch or a git tag.

2. Workflow Trigger

The Policy Definitions workflow is designed to be triggered manually. It is not configured to be triggered by code changes in the repository.

3. Jobs

3.1 Initiation

This job is the entry point of the workflow. It uses the custom action initiation. It simply displays the current UTC time and environment variables on the agent for debugging purposes.

3.2 Policy Tests

This job uses the custom action test-policy-def to perform Pester tests defined in the open-source PowerShell module AzPolicyTest.

The test results are summarized and written to the job summary using the custom action parse-pester-results.

3.3 Build Dev and Build Prod

These jobs use the custom action build-policy-def to populate the paths of each policy definition JSON file and add them to the Policy Definition Bicep template file.

These JSON files will then get loaded at compile time by the Policy Definition bicep module using the LoadJsonContent() Bicep function.

The updated Bicep template file is then stored as build artifacts.

3.4 Test Dev and Test Prod

These jobs use the custom action test-validate to perform a set of tests on the Bicep templates generated in the Build Dev and Build Prod jobs respectively.

The tests include:

NOTE: At the time of writing this document, the PSRule for Azure module does not provide any tests for policy resources. Also the ARM What-If validation does not work with policy resources (This issue has been reported on What-If's issue tracker on GitHub).

3.5 Deploy Dev

This job uses the custom action bicep-deployment to deploy the policy definitions Bicep template generated from the Build Dev job upon successful completion of the Test Dev job.

The policy definitions Bicep template does not require any parameter files.

Although only a single deployment job is created to deploy all the policy definitions, the bicep templates are designed to create them concurrently (with up to 15 concurrent resource deployment defined in Bicep).

3.6 Deploy Prod

Same as the Deploy Dev job, this job uses the custom action bicep-deployment.

It deploys the policy definitions Bicep template generated from the Build Prod job upon successful completion of the Test Prod and Deploy Dev jobs.

The condition for this job also dictates that the workflow must be triggered from the main branch for this job to start.