governance_assignments

Creates, updates, deletes, gets or lists a governance_assignments resource.

Overview

Name	governance_assignments
Type	Resource
Id	azure.security.governance_assignments

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
additionalData	object	The additional data for the governance assignment - e.g. links to ticket (optional), see example.
governanceEmailNotification	object	The email notifications settings for the governance rule, states whether to disable notifications for mangers and owners.
isGracePeriod	boolean	Defines whether there is a grace period on the governance assignment.
owner	string	The Owner for the governance assignment - e.g. user@contoso.com _ - see example.
remediationDueDate	string (date-time)	The remediation due-date - after this date Secure Score will be affected (in case of active grace-period). Required.
remediationEta	object	The ETA (estimated time of arrival) for remediation (optional), see example.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
additionalData	object	The additional data for the governance assignment - e.g. links to ticket (optional), see example.
governanceEmailNotification	object	The email notifications settings for the governance rule, states whether to disable notifications for mangers and owners.
isGracePeriod	boolean	Defines whether there is a grace period on the governance assignment.
owner	string	The Owner for the governance assignment - e.g. user@contoso.com _ - see example.
remediationDueDate	string (date-time)	The remediation due-date - after this date Secure Score will be affected (in case of active grace-period). Required.
remediationEta	object	The ETA (estimated time of arrival) for remediation (optional), see example.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, assessment_name, assignment_key		Get a specific governanceAssignment for the requested scope by AssignmentKey.
list	select	scope, assessment_name		Get governance assignments on all of your resources inside a scope.
create_or_update	insert	scope, assessment_name, assignment_key		Creates or updates a governance assignment on the given subscription.
create_or_update	replace	scope, assessment_name, assignment_key		Creates or updates a governance assignment on the given subscription.
delete	delete	scope, assessment_name, assignment_key		Delete a GovernanceAssignment over a given scope.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
assessment_name	string	The assessment key of the governance assignment. Required.
assignment_key	string	The governance assignment key. Required.
scope	string	The scope of the governance assignment. Required.

SELECT examples

get

Get a specific governanceAssignment for the requested scope by AssignmentKey.

SELECT
id,
name,
additionalData,
governanceEmailNotification,
isGracePeriod,
owner,
remediationDueDate,
remediationEta,
systemData,
type
FROM azure.security.governance_assignments
WHERE scope = '{{ scope }}' -- required
AND assessment_name = '{{ assessment_name }}' -- required
AND assignment_key = '{{ assignment_key }}' -- required
;

list

Get governance assignments on all of your resources inside a scope.

SELECT
id,
name,
additionalData,
governanceEmailNotification,
isGracePeriod,
owner,
remediationDueDate,
remediationEta,
systemData,
type
FROM azure.security.governance_assignments
WHERE scope = '{{ scope }}' -- required
AND assessment_name = '{{ assessment_name }}' -- required
;

INSERT examples

create_or_update

Creates or updates a governance assignment on the given subscription.

INSERT INTO azure.security.governance_assignments (
properties,
scope,
assessment_name,
assignment_key
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ assessment_name }}',
'{{ assignment_key }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: governance_assignments
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the governance_assignments resource.
  - name: assessment_name
    value: "{{ assessment_name }}"
    description: Required parameter for the governance_assignments resource.
  - name: assignment_key
    value: "{{ assignment_key }}"
    description: Required parameter for the governance_assignments resource.
  - name: properties
    description: |
      The properties of a governance assignment.
    value:
      owner: "{{ owner }}"
      remediationDueDate: "{{ remediationDueDate }}"
      remediationEta:
        eta: "{{ eta }}"
        justification: "{{ justification }}"
      isGracePeriod: {{ isGracePeriod }}
      governanceEmailNotification:
        disableManagerEmailNotification: {{ disableManagerEmailNotification }}
        disableOwnerEmailNotification: {{ disableOwnerEmailNotification }}
      additionalData:
        ticketNumber: {{ ticketNumber }}
        ticketLink: "{{ ticketLink }}"
        ticketStatus: "{{ ticketStatus }}"

REPLACE examples

create_or_update

Creates or updates a governance assignment on the given subscription.

REPLACE azure.security.governance_assignments
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND assessment_name = '{{ assessment_name }}' --required
AND assignment_key = '{{ assignment_key }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Delete a GovernanceAssignment over a given scope.

DELETE FROM azure.security.governance_assignments
WHERE scope = '{{ scope }}' --required
AND assessment_name = '{{ assessment_name }}' --required
AND assignment_key = '{{ assignment_key }}' --required
;