Skip to content

Commit c1cb52f

Browse files
pilorpilor
authored
Microsoft.PolicyInsights/checkPolicyRestrictions API (#10798)
* CheckPolicyRestrictions API * Run prettier * Increment package version * Remove from old tag * Remove suppression
1 parent abc4477 commit c1cb52f

File tree

7 files changed

+660
-1
lines changed

7 files changed

+660
-1
lines changed

‎specification/policyinsights/resource-manager/Microsoft.PolicyInsights/stable/2019-10-01/policyStates.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1398,6 +1398,11 @@
13981398
"description": "Expression evaluated.",
13991399
"type": "string"
14001400
},
1401+
"expressionKind": {
1402+
"description": "The kind of expression that was evaluated.",
1403+
"type": "string",
1404+
"readOnly": true
1405+
},
14011406
"path": {
14021407
"description": "Property path if the expression is a field or an alias.",
14031408
"type": "string"

‎specification/policyinsights/resource-manager/Microsoft.PolicyInsights/stable/2020-07-01/checkPolicyRestrictions.json‎

Lines changed: 320 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,320 @@
1+
{
2+
"swagger": "2.0",
3+
"info": {
4+
"title": "CheckPolicyRestrictionsClient",
5+
"version": "2020-07-01"
6+
},
7+
"host": "management.azure.com",
8+
"schemes": [
9+
"https"
10+
],
11+
"produces": [
12+
"application/json"
13+
],
14+
"security": [
15+
{
16+
"azure_auth": [
17+
"user_impersonation"
18+
]
19+
}
20+
],
21+
"securityDefinitions": {
22+
"azure_auth": {
23+
"type": "oauth2",
24+
"authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
25+
"flow": "implicit",
26+
"description": "Azure Active Directory OAuth2 Flow",
27+
"scopes": {
28+
"user_impersonation": "impersonate your user account"
29+
}
30+
}
31+
},
32+
"paths": {
33+
"/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/checkPolicyRestrictions": {
34+
"post": {
35+
"operationId": "PolicyRestrictions_CheckAtSubscriptionScope",
36+
"description": "Checks what restrictions Azure Policy will place on a resource within a subscription.",
37+
"parameters": [
38+
{
39+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
40+
},
41+
{
42+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
43+
},
44+
{
45+
"name": "parameters",
46+
"in": "body",
47+
"required": true,
48+
"schema": {
49+
"$ref": "#/definitions/CheckRestrictionsRequest"
50+
},
51+
"description": "The check policy restrictions parameters."
52+
}
53+
],
54+
"responses": {
55+
"200": {
56+
"description": "The restrictions that will be placed on the resource by Azure Policy.",
57+
"schema": {
58+
"$ref": "#/definitions/CheckRestrictionsResult"
59+
}
60+
},
61+
"default": {
62+
"description": "Error response describing why the operation failed.",
63+
"schema": {
64+
"$ref": "../../stable/2019-10-01/policyMetadata.json#/definitions/ErrorResponse"
65+
}
66+
}
67+
},
68+
"x-ms-examples": {
69+
"Check policy restrictions at subscription scope": {
70+
"$ref": "./examples/PolicyRestrictions_CheckAtSubscriptionScope.json"
71+
}
72+
}
73+
}
74+
},
75+
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/checkPolicyRestrictions": {
76+
"post": {
77+
"operationId": "PolicyRestrictions_CheckAtResourceGroupScope",
78+
"description": "Checks what restrictions Azure Policy will place on a resource within a resource group. Use this when the resource group the resource will be created in is already known.",
79+
"parameters": [
80+
{
81+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
82+
},
83+
{
84+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
85+
},
86+
{
87+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
88+
},
89+
{
90+
"name": "parameters",
91+
"in": "body",
92+
"required": true,
93+
"schema": {
94+
"$ref": "#/definitions/CheckRestrictionsRequest"
95+
},
96+
"description": "The check policy restrictions parameters."
97+
}
98+
],
99+
"responses": {
100+
"200": {
101+
"description": "The restrictions that will be placed on the resource by Azure Policy.",
102+
"schema": {
103+
"$ref": "#/definitions/CheckRestrictionsResult"
104+
}
105+
},
106+
"default": {
107+
"description": "Error response describing why the operation failed.",
108+
"schema": {
109+
"$ref": "../../stable/2019-10-01/policyMetadata.json#/definitions/ErrorResponse"
110+
}
111+
}
112+
},
113+
"x-ms-examples": {
114+
"Check policy restrictions at resource group scope": {
115+
"$ref": "./examples/PolicyRestrictions_CheckAtResourceGroupScope.json"
116+
}
117+
}
118+
}
119+
}
120+
},
121+
"definitions": {
122+
"CheckRestrictionsRequest": {
123+
"description": "The check policy restrictions parameters describing the resource that is being evaluated.",
124+
"properties": {
125+
"resourceDetails": {
126+
"description": "The information about the resource that will be evaluated.",
127+
"$ref": "#/definitions/CheckRestrictionsResourceDetails"
128+
},
129+
"pendingFields": {
130+
"description": "The list of fields and values that should be evaluated for potential restrictions.",
131+
"type": "array",
132+
"items": {
133+
"$ref": "#/definitions/PendingField"
134+
}
135+
}
136+
},
137+
"required": [
138+
"resourceDetails"
139+
]
140+
},
141+
"CheckRestrictionsResourceDetails": {
142+
"description": "The information about the resource that will be evaluated.",
143+
"properties": {
144+
"resourceContent": {
145+
"description": "The resource content. This should include whatever properties are already known and can be a partial set of all resource properties.",
146+
"type": "object"
147+
},
148+
"apiVersion": {
149+
"description": "The api-version of the resource content.",
150+
"type": "string"
151+
},
152+
"scope": {
153+
"description": "The scope where the resource is being created. For example, if the resource is a child resource this would be the parent resource's resource ID.",
154+
"type": "string"
155+
}
156+
},
157+
"required": [
158+
"resourceContent"
159+
]
160+
},
161+
"PendingField": {
162+
"description": "A field that should be evaluated against Azure Policy to determine restrictions.",
163+
"properties": {
164+
"field": {
165+
"description": "The name of the field. This can be a top-level property like 'name' or 'type' or an Azure Policy field alias.",
166+
"type": "string"
167+
},
168+
"values": {
169+
"description": "The list of potential values for the field that should be evaluated against Azure Policy.",
170+
"type": "array",
171+
"items": {
172+
"type": "string"
173+
}
174+
}
175+
},
176+
"required": [
177+
"field"
178+
]
179+
},
180+
"CheckRestrictionsResult": {
181+
"description": "The result of a check policy restrictions evaluation on a resource.",
182+
"properties": {
183+
"fieldRestrictions": {
184+
"description": "The restrictions that will be placed on various fields in the resource by policy.",
185+
"type": "array",
186+
"items": {
187+
"$ref": "#/definitions/FieldRestrictions"
188+
},
189+
"readOnly": true
190+
},
191+
"contentEvaluationResult": {
192+
"description": "Evaluation results for the provided partial resource content.",
193+
"properties": {
194+
"policyEvaluations": {
195+
"description": "Policy evaluation results against the given resource content. This will indicate if the partial content that was provided will be denied as-is.",
196+
"type": "array",
197+
"items": {
198+
"$ref": "#/definitions/PolicyEvaluationResult"
199+
}
200+
}
201+
},
202+
"readOnly": true
203+
}
204+
}
205+
},
206+
"FieldRestrictions": {
207+
"description": "The restrictions that will be placed on a field in the resource by policy.",
208+
"properties": {
209+
"field": {
210+
"description": "The name of the field. This can be a top-level property like 'name' or 'type' or an Azure Policy field alias.",
211+
"type": "string",
212+
"readOnly": true
213+
},
214+
"restrictions": {
215+
"description": "The restrictions placed on that field by policy.",
216+
"type": "array",
217+
"items": {
218+
"$ref": "#/definitions/FieldRestriction"
219+
}
220+
}
221+
}
222+
},
223+
"FieldRestriction": {
224+
"description": "The restrictions on a field imposed by a specific policy.",
225+
"properties": {
226+
"result": {
227+
"description": "The type of restriction that is imposed on the field.",
228+
"type": "string",
229+
"enum": [
230+
"Required",
231+
"Removed",
232+
"Deny"
233+
],
234+
"x-ms-enum": {
235+
"name": "FieldRestrictionResult",
236+
"modelAsString": true,
237+
"values": [
238+
{
239+
"value": "Required",
240+
"description": "The field and/or values are required by policy."
241+
},
242+
{
243+
"value": "Removed",
244+
"description": "The field will be removed by policy."
245+
},
246+
{
247+
"value": "Deny",
248+
"description": "The field and/or values will be denied by policy."
249+
}
250+
]
251+
},
252+
"readOnly": true
253+
},
254+
"defaultValue": {
255+
"description": "The value that policy will set for the field if the user does not provide a value.",
256+
"type": "string",
257+
"readOnly": true
258+
},
259+
"values": {
260+
"description": "The values that policy either requires or denies for the field.",
261+
"type": "array",
262+
"items": {
263+
"type": "string"
264+
},
265+
"readOnly": true
266+
},
267+
"policy": {
268+
"description": "The details of the policy that is causing the field restriction.",
269+
"$ref": "#/definitions/PolicyReference",
270+
"readOnly": true
271+
}
272+
}
273+
},
274+
"PolicyEvaluationResult": {
275+
"description": "The result of a non-compliant policy evaluation against the given resource content.",
276+
"properties": {
277+
"policyInfo": {
278+
"description": "The details of the policy that was evaluated.",
279+
"$ref": "#/definitions/PolicyReference",
280+
"readOnly": true
281+
},
282+
"evaluationResult": {
283+
"description": "The result of the policy evaluation against the resource. This will typically be 'NonCompliant' but may contain other values if errors were encountered.",
284+
"type": "string",
285+
"readOnly": true
286+
},
287+
"evaluationDetails": {
288+
"description": "The detailed results of the policy expressions and values that were evaluated.",
289+
"$ref": "../../stable/2019-10-01/policyStates.json#/definitions/PolicyEvaluationDetails",
290+
"readOnly": true
291+
}
292+
}
293+
},
294+
"PolicyReference": {
295+
"description": "Resource identifiers for a policy.",
296+
"properties": {
297+
"policyDefinitionId": {
298+
"description": "The resource identifier of the policy definition.",
299+
"type": "string",
300+
"readOnly": true
301+
},
302+
"policySetDefinitionId": {
303+
"description": "The resource identifier of the policy set definition.",
304+
"type": "string",
305+
"readOnly": true
306+
},
307+
"policyDefinitionReferenceId": {
308+
"description": "The reference identifier of a specific policy definition within a policy set definition.",
309+
"type": "string",
310+
"readOnly": true
311+
},
312+
"policyAssignmentId": {
313+
"description": "The resource identifier of the policy assignment.",
314+
"type": "string",
315+
"readOnly": true
316+
}
317+
}
318+
}
319+
}
320+
}

0 commit comments

Comments
 (0)