Bug Report - Policy Deploy-Storage-sslEnforcement

[Felix-Tr]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform: 1.1.3

azure provider: >= 2.20, < 3.0.0

module: archetypes

Description

The Policy is used to enforce the Recommendation Secure transfer to storage accounts should be enabled but causes an Error because of the following miss-match regarding the resource type.

Line 66:

          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
                "equals": "true"
              },
              {
                "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
                "equals": "[parameters('minimumTlsVersion')]"
              },
              {
                "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
                "equals": "false"
              }
            ]
          },

should be:

          "type": "Microsoft.Storage/storageAccounts",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
                "equals": "true"
              },
              {
                "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
                "equals": "[parameters('minimumTlsVersion')]"
              }
            ]
          },

to correct the type and only set the existenceCondition=True if secure transfer (supportsHttpsTrafficOnly) is enabled

1. apply module
2. wait for provisioning of resources
3. check policy compliance in the azure portal

Screenshots

[krowlandson]

@Felix-Tr thank you for logging this issue.

I've moved it to our upstream repository for triage where all policies are maintained for ES/ALZ.

cc: @jtracey93, @matt-FFFFFF