internal/functions/Build-ExemptionsPlan.ps1
|
function Build-ExemptionsPlan { [CmdletBinding()] param ( [string] $exemptionsRootFolder, [string] $exemptionsAreNotManagedMessage, [hashtable] $pacEnvironment, [hashtable] $allAssignments, [hashtable] $assignments, [hashtable] $deployedExemptions, [hashtable] $exemptions ) Write-Information "===================================================================================================" Write-Information "Processing Policy Exemption files in folder '$exemptionsRootFolder'" Write-Information "===================================================================================================" if ($exemptionsAreNotManagedMessage -ne "") { Write-Warning $exemptionsAreNotManagedMessage } else { [array] $exemptionFiles = @() # Do not manage exemptions if directory does not exist $exemptionFiles += Get-ChildItem -Path $exemptionsRootFolder -Recurse -File -Filter "*.json" $exemptionFiles += Get-ChildItem -Path $exemptionsRootFolder -Recurse -File -Filter "*.jsonc" $exemptionFiles += Get-ChildItem -Path $exemptionsRootFolder -Recurse -File -Filter "*.csv" $allExemptions = @{} $deployedManagedExemptions = $deployedExemptions.managed $deleteCandidates = Get-HashtableShallowClone $deployedManagedExemptions $replacedAssignments = $assignments.replace if ($exemptionFiles.Length -eq 0) { Write-Warning "No Policy Exemption files found." Write-Warning "All exemptions will be deleted!" Write-Information "" } else { Write-Information "Number of Policy Exemption files = $($exemptionFiles.Length)" $now = Get-Date -AsUTC [System.Collections.ArrayList] $exemptionArrayList = [System.Collections.ArrayList]::new() foreach ($file in $exemptionFiles) { $extension = $file.Extension $fullName = $file.FullName Write-Information "Processing file '$($fullName)'" if ($extension -eq ".json" -or $extension -eq ".jsonc") { $content = Get-Content -Path $fullName -Raw -ErrorAction Stop if (!(Test-Json $content)) { Write-Error "Invalid JSON in file $($assignmentFile.FullName)'" -ErrorAction Stop } $jsonObj = ConvertFrom-Json $content -AsHashtable -Depth 100 Write-Information "" if ($null -ne $jsonObj) { $jsonExemptions = $jsonObj.exemptions if ($null -ne $jsonExemptions -and $jsonExemptions.Count -gt 0) { $null = $exemptionArrayList.AddRange($jsonExemptions) } } } elseif ($extension -eq ".csv") { $content = Get-Content -Path $fullName -Raw -ErrorAction Stop $xlsExemptionArray = @() + ($content | ConvertFrom-Csv -ErrorAction Stop) # Adjust flat structure from spreadsheets to the almost flat structure in JSON foreach ($row in $xlsExemptionArray) { $policyDefinitionReferenceIds = @() $step1 = $row.policyDefinitionReferenceIds if ($null -ne $step1 -and $step1 -ne "") { $step2 = $step1.Trim() $step3 = $step2 -split "," foreach ($item in $step3) { $step4 = $item.Trim() if ($step4.Length -gt 0) { $policyDefinitionReferenceIds += $step4 } } } $metadata = $null $step1 = $row.metadata if ($null -ne $step1 -and $step1 -ne "") { $step2 = $step1.Trim() if ($step2.StartsWith("{") -and (Test-Json $step2)) { $step3 = ConvertFrom-Json $step2 -AsHashtable -Depth 100 if ($step3 -ne @{}) { $metadata = $step3 } } else { Write-Error " Invalid metadata format, must be empty or legal JSON: '$step2'" } } $assignmentScopeValidation = "Default" if ($null -ne $row.assignmentScopeValidation) { if ($row.assignmentScopeValidation -in ("Default", "DoNotValidate")) { $assignmentScopeValidation = $row.assignmentScopeValidation } else { Write-Error " Invalid assignmentScopeValidation value, must be 'Default' or 'DoNotValidate': '$($row.assignmentScopeValidation)'" } } $exemption = @{ name = $row.name displayName = $row.displayName description = $row.description exemptionCategory = $row.exemptionCategory expiresOn = $row.expiresOn scope = $row.scope policyAssignmentId = $row.policyAssignmentId policyDefinitionReferenceIds = $policyDefinitionReferenceIds metadata = $metadata assignmentScopeValidation = $assignmentScopeValidation } if ($null -ne $row.resourceSelectors) { $exemption.resourceSelectors = $row.resourceSelectors } $null = $exemptionArrayList.Add($exemption) } } } foreach ($exemptionRaw in $exemptionArrayList) { # Validate the content, remove extraneous columns $name = $exemptionRaw.name $displayName = $exemptionRaw.displayName $description = $exemptionRaw.description $exemptionCategory = $exemptionRaw.exemptionCategory $scope = $exemptionRaw.scope $policyAssignmentId = $exemptionRaw.policyAssignmentId $policyDefinitionReferenceIds = $exemptionRaw.policyDefinitionReferenceIds $metadata = $exemptionRaw.metadata $assignmentScopeValidation = $exemptionRaw.assignmentScopeValidation if ($null -eq $assignmentScopeValidation) { $assignmentScopeValidation = "Default" } $resourceSelectors = $exemptionRaw.resourceSelectors if (($null -eq $name -or $name -eq '') -or ($null -eq $exemptionCategory -or $exemptionCategory -eq '') -or ($null -eq $scope -or $scope -eq '') -or ($null -eq $policyAssignmentId -or $policyAssignmentId -eq '')) { if (-not (($null -eq $name -or $name -eq '') -and ($null -eq $exemptionCategory -or $exemptionCategory -eq '') ` -and ($null -eq $scope -or $scope -eq '') -and ($null -eq $policyAssignmentId -or $policyAssignmentId -eq '') ` -and ($null -eq $displayName -or $displayName -eq "") -and ($null -eq $description -or $description -eq "") ` -and ($null -eq $expiresOnRaw -or $expiresOnRaw -eq "") -and ($null -eq $metadata) ` -and ($null -eq $policyDefinitionReferenceIds -or $policyDefinitionReferenceIds.Count -eq 0))) { #ignore empty lines from CSV Write-Error " Exemption is missing one or more of required fields name($name), scope($scope) and policyAssignmentId($policyAssignmentId)" -ErrorAction Stop } } $id = "$scope/providers/Microsoft.Authorization/policyExemptions/$name" if ($allExemptions.ContainsKey($id)) { Write-Error " Duplicate exemption id (name=$name, scope=$scope)" -ErrorAction Stop } $exemption = @{ id = $id name = $name scope = $scope policyAssignmentId = $policyAssignmentId exemptionCategory = $exemptionCategory assignmentScopeValidation = $assignmentScopeValidation } if ($displayName -and $displayName -ne "") { $null = $exemption.Add("displayName", $displayName) } if ($description -and $description -ne "") { $null = $exemption.Add("description", $description) } if ($resourceSelectors) { $null = $exemption.Add("resourceSelectors", $resourceSelectors) } $expiresOn = $null $expired = $false $expiresOnRaw = $exemptionRaw.expiresOn if ($null -ne $expiresOnRaw) { if ($expiresOnRaw -is [datetime]) { $expiresOn = $expiresOnRaw } elseif ($expiresOnRaw -is [string]) { if ($expiresOnRaw -ne "") { try { $expiresOn = [datetime]::Parse($expiresOnRaw, $null, [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal) } catch { Write-Error "$_" -ErrorAction Stop } } } else { Write-Error "expiresOn field '$($expiresOnRaw)' is not a recognized type $($expiresOnRaw.GetType().Name)" -ErrorAction Stop } } if ($null -ne $expiresOn) { $expired = $expiresOn -lt $now $null = $exemption.Add("expiresOn", $expiresOn) } if ($policyDefinitionReferenceIds -and $policyDefinitionReferenceIds.Count -gt 0) { $null = $exemption.Add("policyDefinitionReferenceIds", $policyDefinitionReferenceIds) } else { $policyDefinitionReferenceIds = $null } if ($metadata -and $metadata -ne @{} -and $metadata -ne "") { $null = $exemption.Add("metadata", $metadata) } else { $metadata = $null } # Filter orphaned and expired Exemptions in definitions; deleteCandidates will delete it from environment if it is still deployed if ($expired) { Write-Warning "Expired exemption (name=$name, scope=$scope) in definitions" continue } if (!$allAssignments.ContainsKey($policyAssignmentId)) { Write-Warning "Orphaned exemption (name=$name, scope=$scope) in definitions" continue } # Calculate desired state mandated changes $null = $allExemptions.Add($id, $exemption) if ($deployedManagedExemptions.ContainsKey($id)) { $deleteCandidates.Remove($id) $deployedManagedExemption = $deployedManagedExemptions.$id if ($deployedManagedExemption.policyAssignmentId -ne $policyAssignmentId) { # Replaced Assignment Write-Information "Replace(assignment) '$($name)', '$($scope)'" $null = $exemptions.replace.Add($id, $exemption) $exemptions.numberOfChanges++ } elseif ($replacedAssignments.ContainsKey($policyAssignmentId)) { # Replaced Assignment Write-Information "Replace(reference) '$($name)', '$($scope)'" $null = $exemptions.replace.Add($id, $exemption) $exemptions.numberOfChanges++ } else { # Maybe update existing Exemption $displayNameMatches = $deployedManagedExemption.displayName -eq $displayName $descriptionMatches = $deployedManagedExemption.description -eq $description $exemptionCategoryMatches = $deployedManagedExemption.exemptionCategory -eq $exemptionCategory $expiresOnMatches = $deployedManagedExemption.expiresOn -eq $expiresOn $clearExpiration = $false if (-not $expiresOnMatches) { if ($null -eq $expiresOn) { $null = $exemption.Add("clearExpiration", $true) $clearExpiration = $true } } $policyDefinitionReferenceIdsMatches = Confirm-ObjectValueEqualityDeep $deployedManagedExemption.policyDefinitionReferenceIds $policyDefinitionReferenceIds $metadataMatches = Confirm-MetadataMatches ` -existingMetadataObj $deployedManagedExemption.metadata ` -definedMetadataObj $metadata $assignmentScopeValidationMatches = ($deployedManagedExemption.assignmentScopeValidation -eq $assignmentScopeValidation) ` -or ($null -eq $deployedManagedExemption.assignmentScopeValidation -and ($assignmentScopeValidation -eq "Default" -or $null -eq $assignmentScopeValidation)) $resourceSelectorsMatches = Confirm-ObjectValueEqualityDeep $deployedManagedExemption.resourceSelectors $resourceSelectors # Update Exemption in Azure if necessary if ($displayNameMatches -and $descriptionMatches -and $exemptionCategoryMatches -and $expiresOnMatches ` -and $policyDefinitionReferenceIdsMatches -and $metadataMatches -and (-not $clearExpiration) ` -and $assignmentScopeValidationMatches -and $resourceSelectorsMatches) { $exemptions.numberUnchanged += 1 } else { # One or more properties have changed if (!$displayNameMatches) { $changesStrings += "displayName" } if (!$descriptionMatches) { $changesStrings += "description" } if (!$policyDefinitionReferenceIdsMatches) { $changesStrings += "referenceIds" } if (!$metadataMatches) { $changesStrings += "metadata" } if (!$exemptionCategoryMatches) { $changesStrings += "exemptionCategory" } if ($clearExpiration) { $changesStrings += "clearExpiration" } elseif (!$expiresOnMatches) { $changesStrings += "expiresOn" } if (!$assignmentScopeValidationMatches) { $changesStrings += "assignmentScopeValidation" } if (!$resourceSelectorsMatches) { $changesStrings += "resourceSelectors" } $changesString = $changesStrings -join "," $exemptions.numberOfChanges++ $null = $exemptions.update.Add($id, $exemption) Write-Information "Update($changesString) '$($name)', '$($scope)'" } } } else { # Create Exemption Write-Information "New '$($name)', '$($scope)'" $null = $exemptions.new.Add($id, $exemption) $exemptions.numberOfChanges++ } } } $exemptions.numberOfOrphans = $deployedExemptions.orphaned.psbase.Count foreach ($exemption in $deployedExemptions.orphaned.Values) { # delete all orphaned exemptions Write-Warning "Delete(orphaned) '$($exemption.name)', '$($exemption.scope)'" $null = $exemptions.delete[$exemption.id] = $exemption $exemptions.numberOfChanges++ } $strategy = $pacEnvironment.desiredState.strategy foreach ($id in $deleteCandidates.Keys) { $exemption = $deployedExemptions.managed[$id] $pacOwner = $exemption.pacOwner $shallDelete = Confirm-DeleteForStrategy -pacOwner $pacOwner -strategy $strategy if ($shallDelete) { Write-Information "Delete '$($exemption.name)', '$($exemption.scope)'" $null = $exemptions.delete[$exemption.id] = $exemption $exemptions.numberOfChanges++ } else { # Write-Information "No delete($pacOwner,$strategy) '$($exemption.name)', '$($exemption.scope)'" } } Write-Information "" if ($exemptions.numberUnchanged -gt 0) { Write-Information "$($exemptions.numberUnchanged) unchanged Exemptions" } if ($exemptions.numberOfOrphans -gt 0) { Write-Information "$($exemptions.numberOfOrphans) orphaned Exemptions" } } Write-Information "" } |