A suite of rules to validate Azure resources against the Cloud Adoption Framework (CAF) using PSRule.
Features of PSRule for CAF include:
This project uses GitHub Issues to track bugs and feature requests. Please search the existing issues before filing new issues to avoid duplicates.
If you have any problems with the PSRule engine, please check the project GitHub issues page instead.
Support for this project/ product is limited to the resources listed above.
This project requires the PSRule
, PSRule.Rules.Azure
and Az
PowerShell modules.
For details on each see install.
You can download and install these modules from the PowerShell Gallery.
Module | Description | Downloads / instructions |
---|---|---|
PSRule.Rules.CAF | Validate Azure resources against the CAF. | latest / instructions |
PSRule for CAF provides two methods for analyzing Azure resources:
For additional details see the FAQ.
The following example shows how to setup Github Actions to validate templates pre-flight.
microsoft/ps-rule
with modules: 'PSRule.Rules.CAF'
.ps-rule.yaml
in the repository root directory.Example workflow:
# Example: .github/workflows/analyze-arm.yaml
#
# STEP 1: Template validation
#
name: Analyze templates
on:
- pull_request
jobs:
analyze_arm:
name: Analyze templates
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
# STEP 3: Run analysis against PSRule for Cloud Adoption Framework
- name: Test Azure Infrastructure as Code
uses: microsoft/ps-rule@v2.0.0
with:
modules: 'PSRule.Rules.CAF'
Example PSRule options:
# Example: ps-rule.yaml
#
# PSRule configuration
#
# Please see the documentation for all configuration options:
# https://aka.ms/ps-rule/options
include:
module:
- PSRule.Rules.CAF
requires:
PSRule.Rules.CAF: '>=0.3.0'
output:
culture:
- en-US
configuration:
# Enable expansion for Bicep source files.
AZURE_BICEP_FILE_EXPANSION: true
# Enable expansion for template expansion.
AZURE_PARAMETER_FILE_EXPANSION: true
The following example shows how to setup Azure Pipelines to validate templates pre-flight.
PSRule analysis
task.
modules
to PSRule.Rules.CAF
.ps-rule.yaml
in the repository root directory.Example pipeline:
# Example: .pipelines/analyze-arm.yaml
#
# STEP 2: Template validation
#
jobs:
- job: 'analyze_arm'
displayName: 'Analyze templates'
pool:
vmImage: 'ubuntu-20.04'
steps:
# STEP 3: Run analysis against PSRule for Cloud Adoption Framework
- task: ps-rule-assert@1
displayName: Test Azure Infrastructure as Code
inputs:
modules: 'PSRule.Rules.CAF'
Example PSRule options:
# Example: ps-rule.yaml
#
# PSRule configuration
#
# Please see the documentation for all configuration options:
# https://aka.ms/ps-rule/options
include:
module:
- PSRule.Rules.CAF
requires:
PSRule.Rules.CAF: '>=0.3.0'
output:
culture:
- en-US
configuration:
# Enable expansion for Bicep source files.
AZURE_BICEP_FILE_EXPANSION: true
# Enable expansion for template expansion.
AZURE_PARAMETER_FILE_EXPANSION: true
The following example shows how to setup PSRule locally to validate templates pre-flight.
PSRule.Rules.CAF
module and dependencies from the PowerShell Gallery.ps-rule.yaml
in the repository root directory.Example install command-line:
# STEP 1: Install from the PowerShell Gallery
Install-Module -Name 'PSRule.Rules.CAF' -Scope CurrentUser -Repository PSGallery;
Example PSRule options:
# Example: ps-rule.yaml
#
# PSRule configuration
#
# Please see the documentation for all configuration options:
# https://aka.ms/ps-rule/options
include:
module:
- PSRule.Rules.CAF
requires:
PSRule.Rules.CAF: '>=0.3.0'
output:
culture:
- en-US
configuration:
# Enable expansion for Bicep source files.
AZURE_BICEP_FILE_EXPANSION: true
# Enable expansion for template expansion.
AZURE_PARAMETER_FILE_EXPANSION: true
Example test command-line:
# STEP 3: Test Azure Infrastructure as Code
Assert-PSRule -Module 'PSRule.Rules.CAF' -Format File -InputPath '.';
A number of issues can occur when expanding Azure templates or Bicep source files. Or you may not get any results at all if expansion is not configured. See the following topics:
The following example shows how to setup PSRule locally to validate resources running in a subscription.
PSRule.Rules.CAF
module and dependencies from the PowerShell Gallery.Export-AzRuleData
cmdlet.For example:
# STEP 1: Install PSRule.Rules.CAF from the PowerShell Gallery
Install-Module -Name 'PSRule.Rules.CAF' -Scope CurrentUser;
# STEP 2: Authenticate to Azure, only required if not currently connected
Connect-AzAccount;
# Confirm the current subscription context
Get-AzContext;
# STEP 3: Exports a resource graph stored as JSON for analysis
Export-AzRuleData -OutputPath 'out/templates/';
# STEP 4: Run analysis against exported data
Assert-PSRule -Module 'PSRule.Rules.CAF' -InputPath 'out/templates/';
For a list of rules included in the PSRule.Rules.CAF
module see:
Rules included in this module define a number of configurable values that can be set on an as need basis. By default these values use the standards defined by the CAF. A list of configurable values are included in the reference for each rule.
This module uses commands from the PSRule.Rules.Azure
module to export resource configuration data.
The PSRule.Rules.Azure
module is included as a dependency of PSRule.Rules.CAF
.
For details of PSRule.Rules.Azure
commands see:
Modules in this repository will use the semantic versioning model to declare breaking changes from v1.0.0. Prior to v1.0.0, breaking changes may be introduced in minor (0.x.0) version increments. For a list of module changes please see the change log.
Pre-release module versions are created on major commits and can be installed from the PowerShell Gallery. Pre-release versions should be considered experimental. Modules and change log details for pre-releases will be removed as standard releases are made available.
This project welcomes contributions and suggestions. If you are ready to contribute, please visit the contribution guide.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
This project is licensed under the MIT License.