Add test cases for nested role assignmnents #3168
Conversation
| roleDefinitionIdOrName: 'Reader' | ||
| description: 'Reader Role Assignment' | ||
| principalIds: [ | ||
| 'c99b4f9a-4268-4ab0-bd02-85d160b29a36' // carml-contributor-group |
There was a problem hiding this comment.
This should/must be the ID of an MSI that is deployed in the dependencies.
Co-authored-by: Alexander Sehr <[email protected]>
…tps://github.com/Azure/ResourceModules into users/jpeasier/testCaseForNested/RoleAssignments
| #$resourceTypeIdentifier = $moduleFolderPath.Replace('\', '/').Split('/modules/')[1] | ||
| $resourceTypeIdentifier = (Get-Content (Join-Path $moduleFolderPath 'readme.md')).split('`')[1].substring(1).Replace(']', '') |
There was a problem hiding this comment.
| #$resourceTypeIdentifier = $moduleFolderPath.Replace('\', '/').Split('/modules/')[1] | |
| $resourceTypeIdentifier = (Get-Content (Join-Path $moduleFolderPath 'readme.md')).split('`')[1].substring(1).Replace(']', '') | |
| $readMeContent = Get-Content (Join-Path $moduleFolderPath 'readme.md') | |
| $resourceTypeIdentifier = [regex]::Match($readMeContent[0], '^.*`\[([a-zA-Z\.\/]+)\]`$').Captures.Groups[1].Value |
| foreach ($moduleFolderPath in $moduleFolderPaths) { | ||
| $rbacFilePath = Join-Path $moduleFolderPath '.bicep/nested_roleAssignments.bicep' | ||
| if (Test-Path $rbacFilePath) { | ||
| $nestedFileContent = Get-Content $rbacFilePath |
There was a problem hiding this comment.
I'd suggest to call it not $nestedFileContent but for example $rbacFileContent which would also match the $rbacFilePath
| [string] $resourceTypeIdentifier | ||
| ) | ||
|
|
||
| $hasExpectedResourceType = ($nestedFileContent | Out-String) -match $resourceTypeIdentifier |
There was a problem hiding this comment.
While fine by itself, I would suggest to rather have a test that compares the used resource type with the one we expect as the $resourceTypeIdentifier. So the test would be like $usedExistingResourceType | Should -Be $resourceTypeIdentifier, which has the nice benefit, that a failing tests also tells you how you can fix the error.
To make this work however, you'd need to find the used resource type in the $nestedFileContent. This should be possible by searching for the line that matches 'resource ... existing = {' and then extracting the used resource type.
This final step can be done using the snippet
[regex]::Match($nestedFileContent[$existingResourceTypeRow], "^resource.+'([a-zA-Z\.\/]+)@.+' existing = {$").Captures.Groups[1].Value
Description
Added a Pester test to check if the resource type in the nested roleAssignment bicep is the same as the module.
ToDo: add role assignments to all common test deployments
Issue Referenc: #3162
Pipeline references
Type of Change
Please delete options that are not relevant.
Checklist