functions/roleManagement/roleDefinitions/Test-AzurePIMroleDefinition.ps1
|
function Test-AzurePIMroleDefinition { <# .SYNOPSIS Test desired configuration against a Tenant. .DESCRIPTION Compare current configuration of a resource type with the desired configuration. Return a result object with the required changes and actions. #> [CmdletBinding()] Param ( [System.Management.Automation.PSCmdlet] $Cmdlet = $PSCmdlet ) begin { $resourceName = "roleDefinitions" Test-AzureConnection $secureStringToken = (Get-AzAccessToken -AsSecureString -ResourceUrl $script:apiBaseUrl).Token $token = [System.Net.NetworkCredential]::new('', $secureStringToken).Password $tenant = Get-AzTenant -TenantId (Get-AzContext).Tenant.Id } process { $definitions = $script:desiredConfiguration[$resourceName] foreach ($definition in $definitions) { foreach ($property in $definition.Properties()) { if ($definition.$property.GetType().Name -eq "String") { $definition.$property = Resolve-String -Text $definition.$property } } $result = @{ Tenant = $tenant.Name TenantId = $tenant.Id ResourceType = 'roleDefinition' ResourceName = $definition.roleName DesiredConfiguration = $definition } foreach ($entry in $definition.assignableScopes) { switch (($entry.ToCharArray() | Where-Object {$_ -eq '/'}).count) { 2 {Get-AzSubscription -SubscriptionId $entry.Split("/")[-1] | Out-Null} 4 {Get-AzResourceGroup -Name $entry.split("/")[-1] | Out-Null} 6 {Get-AzResource -Name $entry.split("/")[-1] | Out-Null} default { Write-PSFMessage -Level Warning -String 'AzurePIM.Test.RelatedResourceResolveError' -StringValues "assignableScope", $result.ResourceType, $result.ResourceName -Tag 'failed' $exception = New-Object System.Data.DataException("Cannot resolve assignableScope $($entry)") $errorID = 'RelatedResourceResolveError' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } } } $subscriptionId = Resolve-Subscription -InputReference $definition.subscriptionReference $resource = (Invoke-RestMethod -Method GET -Uri "$($script:apiBaseUrl)$($subscriptionId.trimStart("/"))/providers/Microsoft.Authorization/roleDefinitions?api-version=2018-01-01-preview&`$filter=roleName eq '$($definition.roleName)'" -Headers @{"Authorization"="Bearer $($token)"}).value switch ($resource.count) { 0 { if ($definition.present) { $result = New-TestResult @result -ActionType "Create" } else { $result = New-TestResult @result -ActionType "NoActionRequired" } } 1 { $result["AzureResource"] = $resource if ($resource.properties.type -eq "BuiltInRole") { Write-PSFMessage -Level Warning -String 'AzurePIM.Test.BuiltInRoleDetected' -StringValues $definition.roleName -Tag 'failed' $exception = New-Object System.Data.DataException("BuiltInRole detected.") $errorID = 'BuiltInRoleDetected' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } if ($definition.present) { $changes = @() foreach ($property in ($definition.Properties() | Where-Object {$_ -notin "present","subscriptionReference","sourceConfig"})) { $change = [PSCustomObject] @{ Property = $property Actions = $null } switch ($property) { "permissions" { foreach ($item in ($definition.permissions | Get-Member -Type "NoteProperty").Name) { if ($definition.permissions.$item -and $resource.properties.permissions.$item) { if (Compare-Object -ReferenceObject $definition.permissions.$item -DifferenceObject $resource.properties.permissions.$item) { $change.Actions = @{"Set" = $definition.$property} } } if (($definition.permissions.$item -and (-not ($resource.properties.permissions.$item))) -or ((-not ($definition.permissions.$item)) -and ($resource.properties.permissions.$item))) { $change.Actions = @{"Set" = $definition.$property} } } } "assignableScopes" { if (Compare-Object -ReferenceObject $definition.$property -DifferenceObject $resource.properties.$property) { $change.Actions = @{"Set" = $definition.$property} } } default { if ($definition.$property -ne $resource.properties.$property) { $change.Actions = @{"Set" = $definition.$property} } } } if ($change.Actions) {$changes += $change} } if ($changes.count -gt 0) { $result = New-TestResult @result -Changes $changes -ActionType "Update"} else { $result = New-TestResult @result -ActionType "NoActionRequired" } } else { if ($resource.properties.type -eq "BuiltInRole") { Write-PSFMessage -Level Warning -String 'AzurePIM.Test.BuiltInRoleDetected' -StringValues $definition.roleName -Tag 'failed' $exception = New-Object System.Data.DataException("BuiltInRole detected.") $errorID = 'BuiltInRoleDetected' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } $result = New-TestResult @result -ActionType "Delete" } } default { Write-PSFMessage -Level Warning -String 'AzurePIM.Test.MultipleResourcesError' -StringValues $resourceName, $definition.roleName -Tag 'failed' $exception = New-Object System.Data.DataException("Query returned multiple results. Cannot decide which resource to test.") $errorID = 'MultipleResourcesError' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } } $result } } } |