Field Count Expression Support

[ArmaanMcleod]

Azure Policies can use field count expressions, as shown here: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure?msclkid=b8d82f12a9be11eca152412a44ae0022#field-count

We should include a similar expression in the PSRule engine.

[BernieWhite]

@ArmaanMcleod Can we write.

Example 1

Policy example:

{
    "count": {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]"
    },
    "equals": 0
}

PSRule example:

field: properties.securityRules[*]
count: 0

Example 2

Policy example:

{
    "count": {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
        "where": {
            "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].description",
            "equals": "My unique description"
        }
    },
    "equals": 1
}

PSRule example:

field: properties.securityRules[[email protected]=='My unique description']
count: 1

Example 3

Policy example:

{
    "count": {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
        "where": {
            "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].description",
            "equals": "My common description"
        }
    },
    "greaterOrEquals": 1
}

PSRule example:

field: properties.securityRules[[email protected]=='My unique description']
greaterOrEquals: 1

Example 4

Policy example:

{
    "count": {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
        "where": {
            "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].description",
            "equals": "description"
        }
    },
    "equals": "[length(field('Microsoft.Network/networkSecurityGroups/securityRules[*]'))]"
}

PSRule example: I don't think this is possible without complex expression work because we can't compare the right side as is.

Example 5

Policy example:

{
    "count": {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
        "where": {
            "allOf": [
                {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
                    "equals": "Inbound"
                },
                {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
                    "equals": "Allow"
                },
                {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
                    "equals": "3389"
                }
            ]
        }
    },
    "greater": 0
}

PSRule example:

field: properties.securityRules[[email protected]=='Inbound' && @.access=='Allow' && @.destinationPortRange=='3389']
greater: 0

[ArmaanMcleod]

@BernieWhite I think that should work fine. Example 4 could just be a gap until more complex expression support is introduced. The others can be converted when visiting the policy rules. Could probably move this issue to PSRule.Rules.Azure since the conversion could all be done there.

[BernieWhite]

@ArmaanMcleod It think it is still worth leaving open to make sure we cover it in complex expressions. The first pass of #1045 may not provide all the final features we need.

We could also probably build some docs relating to my examples as well.

[ArmaanMcleod]

@BernieWhite Makes sense, Like that idea.

Also for the 2nd & 3rd example, should it be properties.securityRules[[email protected]=='My unique description'] instead?

since the alias paths are:

• "Microsoft.Network/networkSecurityGroups/securityRules[*]": "properties.securityRules[*]"
• "Microsoft.Network/networkSecurityGroups/securityRules[*].description": "properties.securityRules[*].properties.description"

[ArmaanMcleod]

@BernieWhite Can the below

{
  "count": {
    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
    "where": {
      "allOf": [
        {
          "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix",
          "equals": "*"
        },
        {
          "anyOf": [
            {
              "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
              "equals": "22"
            },
            {
              "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
              "equals": "3389"
            }
          ]
        }
      ]
    }
  },
  "greater": 0
}

be written as:

field: properties.securityRules[[email protected] == '*' && (@.properties.destinationPortRange == '22' || @.properties.destinationPortRange == '3389')]
greater: 0

I havn't played around enough with object path syntax to know if it is possible 😄

[BernieWhite]

@ArmaanMcleod Good question. The .. descendant operator is not supported but the grouping should work. We don't specifically have a test case for it, but ideally it should work if it doesn't.

[ArmaanMcleod]

@BernieWhite With counts like below:

{
  "count": {
    "field": "Microsoft.Network/virtualNetworks/subnets[*]",
    "where": {
      "allOf": [
        {
          "exists": "false",
          "field": "Microsoft.Network/virtualNetworks/subnets[*].routeTable.id"
        },
        {
          "field": "Microsoft.Network/virtualNetworks/subnets[*].name",
          "notIn": [
            "AzureFirewallManagementSubnet",
            "SomeOtherSubnet"
          ]
        }
      ]
    }
  }
}

Thinking we can convert notIn to (@.name != 'AzureFirewallManagementSubnet' && @.name != 'SomeOtherSubnet').

[ArmaanMcleod]

@BernieWhite

Just checking with you if the below:

{
  "count": {
    "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
    "where": {
      "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
      "notIn": [
        "blob",
        "sqlServer"
      ]
    }
  },
  "greaterOrEquals": 1
}

would be converted to:

field: properties.privateLinkServiceConnections[*].properties.groupIds[?(@ != 'blob' && @ != 'sqlServer')]
greaterOrEquals: 1

[BernieWhite]

@ArmaanMcleod That's how I'd do it. Does it work? I don't think we specifically have a test case for that but maybe worth adding any of these to tests at some point.

[ArmaanMcleod]

@ArmaanMcleod That's how I'd do it. Does it work? I don't think we specifically have a test case for that but maybe worth adding any of these to tests at some point.

@BernieWhite Sweet. I'll add a bunch of tests to validate this works. I've found a couple of object path variations that don't have explicit tests. Will add them in at some point.

[BernieWhite]

Sub-selectors and functions as they move forward should address the remaining points that are hard to do with YAML and JSON expressions.