PS changes to show appgw and agc in waf policy #28197

karanbazaz · 2025-07-16T22:25:30Z

Description

Mandatory Checklist

Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

SHOULD update ChangeLog.md file(s) appropriately
- Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
  - A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
- Should not change ChangeLog.md if no new release is required, such as fixing test case only.
SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
SHOULD have proper test coverage for changes in pull request.
SHOULD NOT adjust version of module manually in pull request

For the AGC testing, test was done by uploading the changes to Prod BVT and testing the network call.
Following is the snippet of the network call which was done in BVT environment

function Test-CrossTesting
{
$policy = Get-AzApplicationGatewayFirewallPolicy -Name "testwafpolicy" -ResourceGroupName "appgwTest"

# Check if Application Gateway resource can be seen in WAF Policy
Assert-AreEqual $policy.ApplicationGatewayForContainers.Count 1
Assert-AreEqual $policy.ApplicationGatewayForContainers[0].Id "/subscriptions/66de82f3-ad93-4605-bbdb-237fe7ef3a06/resourcegroups/appgwTest/providers/Microsoft.ServiceNetworking/trafficControllers/test1"

}

Recorder snapshot

{
"Entries": [
{
"RequestUri": "/subscriptions/66de82f3-ad93-4605-bbdb-237fe7ef3a06/resourceGroups/appgwTest/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/testwafpolicy?api-version=2024-07-01",
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNjZkZTgyZjMtYWQ5My00NjA1LWJiZGItMjM3ZmU3ZWYzYTA2L3Jlc291cmNlR3JvdXBzL2FwcGd3VGVzdC9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmsvQXBwbGljYXRpb25HYXRld2F5V2ViQXBwbGljYXRpb25GaXJld2FsbFBvbGljaWVzL3Rlc3R3YWZwb2xpY3k/YXBpLXZlcnNpb249MjAyNC0wNy0wMQ==",
"RequestMethod": "GET",
"RequestHeaders": {
"Accept-Language": [
"en-US"
],
"x-ms-client-request-id": [
"3c7cba41-58c5-44b4-b9ab-0c151d8a00a1"
],
"User-Agent": [
"FxVersion/8.0.1825.31117",
"OSName/Windows",
"OSVersion/Microsoft.Windows.10.0.26100",
"Microsoft.Azure.Management.Network.NetworkManagementClient/27.0.0.0"
]
},
"RequestBody": "",
"ResponseHeaders": {
"Cache-Control": [
"no-cache"
],
"Pragma": [
"no-cache"
],
"ETag": [
"W/"a949eda1-7aa8-45e2-8cb8-a841e9abfda9""
],
"x-ms-request-id": [
"e4bd761a-88f6-41a0-8365-1f0be052247e"
],
"x-ms-correlation-request-id": [
"66c82526-dcbf-4c48-b285-883089b91c92"
],
"x-ms-arm-service-request-id": [
"a2233ca6-235f-4819-afa5-d65697024b56"
],
"Strict-Transport-Security": [
"max-age=31536000; includeSubDomains"
],
"x-ms-ratelimit-remaining-subscription-reads": [
"1099"
],
"x-ms-ratelimit-remaining-subscription-global-reads": [
"16499"
],
"x-ms-routing-request-id": [
"WESTCENTRALUS:20250717T212311Z:66c82526-dcbf-4c48-b285-883089b91c92"
],
"X-Content-Type-Options": [
"nosniff"
],
"X-Cache": [
"CONFIG_NOCACHE"
],
"X-MSEdge-Ref": [
"Ref A: E73FDF56A0D5454CA123397B9E08DFC2 Ref B: CYS013050704031 Ref C: 2025-07-17T21:23:11Z"
],
"Date": [
"Thu, 17 Jul 2025 21:23:11 GMT"
],
"Content-Length": [
"973"
],
"Content-Type": [
"application/json; charset=utf-8"
],
"Expires": [
"-1"
]
},
"ResponseBody": "{\r\n "name": "testwafpolicy",\r\n "id": "/subscriptions/66de82f3-ad93-4605-bbdb-237fe7ef3a06/resourceGroups/appgwTest/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/testwafpolicy",\r\n "etag": "W/\"a949eda1-7aa8-45e2-8cb8-a841e9abfda9\"",\r\n "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",\r\n "location": "eastus2euap",\r\n "properties": {\r\n "provisioningState": "Succeeded",\r\n "customRules": [],\r\n "policySettings": {\r\n "requestBodyCheck": true,\r\n "maxRequestBodySizeInKb": 128,\r\n "fileUploadLimitInMb": 100,\r\n "state": "Disabled",\r\n "mode": "Detection",\r\n "requestBodyInspectLimitInKB": 128,\r\n "fileUploadEnforcement": true,\r\n "requestBodyEnforcement": true\r\n },\r\n "managedRules": {\r\n "managedRuleSets": [\r\n {\r\n "ruleSetType": "Microsoft_DefaultRuleSet",\r\n "ruleSetVersion": "2.1",\r\n "ruleGroupOverrides": []\r\n }\r\n ],\r\n "exclusions": []\r\n },\r\n "applicationGatewayForContainers": [\r\n {\r\n "id": "/subscriptions/66de82f3-ad93-4605-bbdb-237fe7ef3a06/resourcegroups/appgwtest/providers/microsoft.servicenetworking/trafficcontrollers/test1"\r\n }\r\n ]\r\n }\r\n}",
"StatusCode": 200
}
],
"Names": {},
"Variables": {
"SubscriptionId": "66de82f3-ad93-4605-bbdb-237fe7ef3a06"
}
}

azure-client-tools-bot-prd · 2025-07-16T22:25:32Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

Copilot

Pull Request Overview

This PR adds support for displaying Application Gateway and Application Gateway for Containers resources within WAF (Web Application Firewall) policy objects. The change enables users to see which Application Gateway resources are associated with a particular WAF policy.

Added two new properties to the WAF policy model to reference associated Application Gateway resources
Added test validation to verify the Application Gateway reference is properly populated in the WAF policy

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
PSApplicationGatewayWebApplicationFirewallPolicy.cs	Added ApplicationGateways and ApplicationGatewayForContainers properties to the WAF policy model
ApplicationGatewayTests.ps1	Added test assertions to verify Application Gateway reference in WAF policy and fixed typo in comment

Copilot · 2025-07-16T22:25:54Z

src/Network/Network/Models/PSApplicationGatewayWebApplicationFirewallPolicy.cs

+        public System.Collections.Generic.IList<ApplicationGateway> ApplicationGateways { get; set; }
+
+        public System.Collections.Generic.IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }


Use the shorter 'IList' instead of the fully qualified 'System.Collections.Generic.IList' since 'System.Collections.Generic' is already imported at the top of the file.

Suggested change

public System.Collections.Generic.IList<ApplicationGateway> ApplicationGateways { get; set; }

public System.Collections.Generic.IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }

public IList<ApplicationGateway> ApplicationGateways { get; set; }

public IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }

Copilot · 2025-07-16T22:25:54Z

src/Network/Network/Models/PSApplicationGatewayWebApplicationFirewallPolicy.cs

+        public System.Collections.Generic.IList<ApplicationGateway> ApplicationGateways { get; set; }
+
+        public System.Collections.Generic.IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }


Use the shorter 'IList' instead of the fully qualified 'System.Collections.Generic.IList' since 'System.Collections.Generic' is already imported at the top of the file.

Suggested change

public System.Collections.Generic.IList<ApplicationGateway> ApplicationGateways { get; set; }

public System.Collections.Generic.IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }

public IList<ApplicationGateway> ApplicationGateways { get; set; }

public IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }

microsoft-github-policy-service · 2025-07-16T22:25:57Z

Thank you for your contribution @karanbazaz! We will review the pull request and get back to you soon.

YanaXu · 2025-07-17T00:57:26Z

Please join your github account to Azure org.

Link your GitHub Account with Microsoft Account on this page: Open Source Management Portal / Account link
Join below organizations on this page: Open Source Management Portal / Organizations
- Azure

YanaXu · 2025-07-17T00:57:36Z

/azp run

azure-pipelines · 2025-07-17T00:57:51Z

Azure Pipelines successfully started running 3 pipeline(s).

YanaXu · 2025-07-17T06:19:04Z

/azp run

azure-pipelines · 2025-07-17T06:19:19Z

Azure Pipelines successfully started running 3 pipeline(s).

YanaXu · 2025-07-18T01:36:48Z

/azp run

azure-pipelines · 2025-07-18T01:37:03Z

Azure Pipelines successfully started running 3 pipeline(s).

YanaXu · 2025-07-18T03:25:05Z

Hi @karanbazaz , please update src/Network/Network/ChangeLog.md for your change.

cdxu-147 · 2025-07-18T19:09:04Z

src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

@@ -3027,7 +3027,11 @@ function Test-ApplicationGatewayTopLevelFirewallPolicy
 		$appgw = Get-AzApplicationGateway -Name $appgwName -ResourceGroupName $rgname
 		$policy = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname

-		# Second check firewll policy
+		# Check if Application Gateway resource can be seen in WAF Policy


Can you add a comment here explaining we are depending on a manually created AGC-security policy deployment in which subs and which rg?

this is to check the application gateway resource id. For the AGC end to end test details are there in the description section.

Sorry I thought those are the changes for AGC. So we are not adding scenario tests to verify if AGC are referencing the waf policy? If there is anything related can you share a link here?

Shawnli222 · 2025-07-18T19:08:21Z

src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

@@ -3027,7 +3027,11 @@ function Test-ApplicationGatewayTopLevelFirewallPolicy
 		$appgw = Get-AzApplicationGateway -Name $appgwName -ResourceGroupName $rgname
 		$policy = Get-AzApplicationGatewayFirewallPolicy -Name $wafPolicyName -ResourceGroupName $rgname

-		# Second check firewll policy
+		# Check if Application Gateway resource can be seen in WAF Policy


I dont see the new test, are you planning to write a new test? I see the test recording with a new test name

example:
https://github.com/Azure/azure-powershell/pull/24425/files#diff-8246fd889bc16feb6d86237629d27aaab4218db5d1eda39aec6b2b6e846804ff

need it inside ApplicationGatewayTests.cs and ApplicationGatewayTests.ps1

I dont need to create a new test to test the application gateway policy since the data is already there in the test. The test recording is the for the prod test which I did for the application gateway for containers field. Details are there in the description section.

Shawnli222 · 2025-07-18T19:10:58Z

...Tests/TestApplicationGatewayTopLevelFirewallPolicy_with_ApplicationGatewayForContainers.json

@@ -0,0 +1,83 @@
+{
+  "Entries": [


if no test is added, dont think we need recording, check with PS team

this recording is for the end to end test for AGC. Who can i check with in the ps team?

PS changes to show appgw and agc in waf policy

76a0090

Copilot AI review requested due to automatic review settings July 16, 2025 22:25

Copilot AI reviewed Jul 16, 2025

View reviewed changes

microsoft-github-policy-service bot added the customer-reported label Jul 16, 2025

Adding test file and docs

3a1b9de

YanaXu removed the customer-reported label Jul 18, 2025

cdxu-147 reviewed Jul 18, 2025

View reviewed changes

Shawnli222 reviewed Jul 18, 2025

View reviewed changes

		public System.Collections.Generic.IList<ApplicationGateway> ApplicationGateways { get; set; }

		public System.Collections.Generic.IList<ApplicationGatewayForContainersReferenceDefinition> ApplicationGatewayForContainers { get; set; }

PS changes to show appgw and agc in waf policy #28197

Are you sure you want to change the base?

PS changes to show appgw and agc in waf policy #28197

Conversation

karanbazaz commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd bot commented Jul 16, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

microsoft-github-policy-service bot commented Jul 16, 2025

Uh oh!

YanaXu commented Jul 17, 2025

Uh oh!

YanaXu commented Jul 17, 2025

Uh oh!

azure-pipelines bot commented Jul 17, 2025

Uh oh!

YanaXu commented Jul 17, 2025

Uh oh!

azure-pipelines bot commented Jul 17, 2025

Uh oh!

YanaXu commented Jul 18, 2025

Uh oh!

azure-pipelines bot commented Jul 18, 2025

Uh oh!

YanaXu commented Jul 18, 2025

Uh oh!

cdxu-147 Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

karanbazaz Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

cdxu-147 Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

Shawnli222 Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

karanbazaz Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

Shawnli222 Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

karanbazaz Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

karanbazaz commented Jul 16, 2025 •

edited

Loading