azure_policy_insights_query_results resource
Use the azure_policy_insights_query_results InSpec audit resource to test properties and configuration of multiple Azure Policy Insights query results.
Azure REST API version, endpoint, and HTTP client parameters
This resource interacts with API versions supported by the resource provider.
You can specify the api_version as a resource parameter to use a specific version of the Azure REST API.
If you don’t specify an API version, this resource uses the latest version available.
For more information about API versioning, see the azure_generic_resource.
By default, this resource uses the azure_cloud global endpoint and default HTTP client settings.
You can override these settings if you need to connect to a different Azure environment (such as Azure Government or Azure China).
For more information about configuration options, see the resource pack README.
Syntax
An azure_policy_insights_query_results resource block returns all policy insights query results, compliant or not, within a subscription.
describe azure_policy_insights_query_results do
it { should exist }
end
Or
describe azure_policy_insights_query_results do
it { should exist }
end
Parameters
This resource does not require any parameters.
Properties
resource_ids- A list of the unique resource IDs.
Field:
resource_id policy_assignment_ids- A list of all policy assignment IDs.
Field:
policyAssignment_id policy_definition_ids- A list of all policy definition IDs.
Field:
policyDefinition_id is_compliant- A list of boolean flags indicating whether the resource is compliant or not.
Field:
is_compliant subscription_ids- A list of subscription IDs.
Field:
subscription_id resource_types- A list of resource types.
Field:
resource_type resource_locations- A list of resource locations.
Field:
resource_location resource_groups- A list of resource group names.
Field:
resource_group - A list of resource tags.
Field:
resource_tags policy_assignment_names- A list of policy assignment names.
Field:
policy_assignment_name policy_definition_names- A list of policy definition names.
Field:
policy_definition_name policy_assignment_scopes- A list of policy assignment scopes.
Field:
policy_assignment_scope policy_assignment_parameters- A list of policy assignment parameters.
Field:
policy_assignment_parameters policy_definition_actions- A list of policy definition actions.
Field:
policy_definition_action policy_definition_categories- A list of policy definition categories.
Field:
policy_definition_category management_group_ids- A list of management group IDs.
Field:
management_group_ids compliance_states- A list compliance state of the resource.
Field:
compliance_state compliance_reason_codes- A list of reason codes recorded for failure.
Field:
compliance_reason_code
Note
Examples
Check if a specific resource type is present:
describe azure_policy_insights_query_results do
its('resource_types') { should include 'Microsoft.VirtualMachineImages/imageTemplates' }
end
Filters the results to include only those Policy Insights query results that have specified location:
describe azure_policy_insights_query_results.where(resource_location: 'RESOURCE_LOCATION') do
it { should exist }
end
Filters the results to include only the compliant Policy Insights query results:
describe azure_policy_insights_query_results.where(is_compliant: true) do
it { should exist }
its('count') { should be 120 }
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exists
The control passes if the filter returns at least one result. Use should_not if you expect zero matches.
describe azure_policy_insights_query_results do
it { should exist }
end
Azure permissions
Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.