Feature a 'real-world' use of these rules against a large code base

[Rohan Cragg (rohancragg)]

I wanted to see a more substantial example of the rules in action so I have forked a 'reference architecture' repo and tried to implement these checks against it.

Please see here: rohancragg/reliable-web-app-pattern-dotnet#1

It is a fork of Reliable web app pattern for .NET and I've tried to do the absolute minimum to get an analysis of the working. I added a ps-rule.yaml and a test of the main.bicep and ignored other bicep files otherwise there's lots of noise.

I'd welcome feedback on my use of the tool here as I'm still learning!

[Elinora White (ElinoraWhite)]

In the following command-line:

Invoke-PSRule -Format File -InputPath '*.tests.bicep' -Module 'PSRule.Rules.Azure' -Outcome Processed -As Summary

• -Module is the same as setting the include.module option in ps-rule.yaml. So only one is required.
• AZURE_BICEP_CHECK_TOOL and AZURE_BICEP_MINIMUM_VERSION are optional, but can be helpful to troubleshoot if an older version of Bicep is installed. They flag what version of Bicep PSRule is using.
• Ignoring files is typically only required when you are scanning the whole repository. If you only want to process bicep files through tests, you could simplify as:

input:
  pathIgnore:
  # ignore all bicep files except the ones that have been created to test modules
  - '**'
  - '!**/*.tests.bicep'

[Rohan Cragg (rohancragg)]

Many thanks, I've pushed a commit incorporating your feedback.

At the moment I'm ignoring unprocessed objects and I'm unclear what some of these objects are and whether or not we should ignore them - any thoughts?

[Rohan Cragg (rohancragg)]

One example of this is:

FAIL Azure.AppService.WebProbePath (AZR-000080)

Configure a dedicated path for health probe requests.

Template: main.tests.bicep:843:21

Recommend:
Consider using a dedicated health probe endpoint that implements functional
checks.

Reason:

• Path properties.siteConfig.healthCheckPath: Does not exist.

Help:

• https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.WebProbePath/

WARN Target object 'b75070b7-fe55-e2c9-cb45-52cc0575f364' has not been processed because no matching rules were found.
WARN Target object '69a9e5cd-01ce-dce8-ce3e-50ed361fb593' has not been processed because no matching rules were

I assume this relates to Microsoft.ManagedIdentity/userAssignedIdentities for which there are no matching rules? Such as the one here which is referenced in the Microsoft.Web/sites resource here

[Elinora White (ElinoraWhite)]

Correct. Unprocessed objects are objects that don't match any rules. Generally you don't want to know about unprocessed objects, unless you are developing rules or doing initial setup and want to check if custom rules are running.

The names of the resources are reported b75070b7-fe55-e2c9-cb45-52cc0575f364 so it is likely to be a resource that the name is generated from a GUID. The name for that managed identity is web-${resourceToken}-identity.

[Rohan Cragg (rohancragg)]

Thank you. I've left in the rule to ignore unprocessed object for now then. I've also added a GitHub Action to run the rules so I'm happy that this is a good demonstration of the rules in action but I'm not sure if the maintainers of the upstream repo would be interested in merging this and fixing all of the rules?! As you an see there are many issues that would need to be addressed! https://github.com/rohancragg/reliable-web-app-pattern-dotnet/actions/runs/5532135659

[Elinora White (ElinoraWhite)]

You can always try :) Maybe start by logging an issue and discussing it first.

Also, I'm sure they would be more receptive when you open a PR if they are open to changing this code if you have the modules updated. Most of the issues are repeated because they are reusing the same module multiple times.

[Rohan Cragg (rohancragg)]

Thanks for indulging me here. I now see that PsRule is already used in the ALZ-Bicep repo, added here in September last year: Azure/ALZ-Bicep@2120863

[Elinora White (ElinoraWhite)]

You can also checkout AKS-Contruction and ResourceModules as first-party repos, each has a slightly different way they choose to implement based on how the repo is used.

[Rohan Cragg (rohancragg)]

I'm a big fan of AKS-Construction already so I'm surprised that I'd not noticed that, Thanks @BernieWhite