governance_rules

Creates, updates, deletes, gets or lists a governance_rules resource.

Overview

Name	governance_rules
Type	Resource
Id	azure.security.governance_rules

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
conditionSets	array	The governance rule conditionSets - see examples. Required.
description	string	Description of the governance rule.
displayName	string	Display name of the governance rule. Required.
excludedScopes	array	Excluded scopes, filter out the descendants of the scope (on management scopes).
governanceEmailNotification	object	The email notifications settings for the governance rule, states whether to disable notifications for mangers and owners.
includeMemberScopes	boolean	Defines whether the rule is management scope rule (master connector as a single scope or management scope).
isDisabled	boolean	Defines whether the rule is active/inactive.
isGracePeriod	boolean	Defines whether there is a grace period on the governance rule.
metadata	object	The governance rule metadata.
ownerSource	object	The owner source for the governance rule - e.g. Manually by user@contoso.com _ - see example. Required.
remediationTimeframe	string	Governance rule remediation timeframe - this is the time that will affect on the grace-period duration e.g. 7.00:00:00 - means 7 days.
rulePriority	integer	The governance rule priority, priority to the lower number. Rules with the same priority on the same scope will not be allowed. Required.
ruleType	string	The rule type of the governance rule, defines the source of the rule e.g. Integrated. Required. Known values are: "Integrated" and "ServiceNow". (Integrated, ServiceNow)
sourceResourceType	string	The governance rule source, what the rule affects, e.g. Assessments. Required. "Assessments" (Assessments)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId (GUID).
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
conditionSets	array	The governance rule conditionSets - see examples. Required.
description	string	Description of the governance rule.
displayName	string	Display name of the governance rule. Required.
excludedScopes	array	Excluded scopes, filter out the descendants of the scope (on management scopes).
governanceEmailNotification	object	The email notifications settings for the governance rule, states whether to disable notifications for mangers and owners.
includeMemberScopes	boolean	Defines whether the rule is management scope rule (master connector as a single scope or management scope).
isDisabled	boolean	Defines whether the rule is active/inactive.
isGracePeriod	boolean	Defines whether there is a grace period on the governance rule.
metadata	object	The governance rule metadata.
ownerSource	object	The owner source for the governance rule - e.g. Manually by user@contoso.com _ - see example. Required.
remediationTimeframe	string	Governance rule remediation timeframe - this is the time that will affect on the grace-period duration e.g. 7.00:00:00 - means 7 days.
rulePriority	integer	The governance rule priority, priority to the lower number. Rules with the same priority on the same scope will not be allowed. Required.
ruleType	string	The rule type of the governance rule, defines the source of the rule e.g. Integrated. Required. Known values are: "Integrated" and "ServiceNow". (Integrated, ServiceNow)
sourceResourceType	string	The governance rule source, what the rule affects, e.g. Assessments. Required. "Assessments" (Assessments)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId (GUID).
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, rule_id		Get a specific governance rule for the requested scope by ruleId.
list	select	scope		Get a list of all relevant governance rules over a scope.
create_or_update	insert	scope, rule_id		Creates or updates a governance rule over a given scope.
create_or_update	replace	scope, rule_id		Creates or updates a governance rule over a given scope.
delete	delete	scope, rule_id		Delete a Governance rule over a given scope.
execute	exec	scope, rule_id		Execute a governance rule.
operation_results	exec	scope, rule_id, operation_id		Get governance rules long run operation result for the requested scope by ruleId and operationId.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
operation_id	string	The governance rule long running operation unique key. Required.
rule_id	string	The governance rule key. Required.
scope	string	The scope of the governance rule. Required.

SELECT examples

get

Get a specific governance rule for the requested scope by ruleId.

SELECT
id,
name,
conditionSets,
description,
displayName,
excludedScopes,
governanceEmailNotification,
includeMemberScopes,
isDisabled,
isGracePeriod,
metadata,
ownerSource,
remediationTimeframe,
rulePriority,
ruleType,
sourceResourceType,
systemData,
tenantId,
type
FROM azure.security.governance_rules
WHERE scope = '{{ scope }}' -- required
AND rule_id = '{{ rule_id }}' -- required
;

list

Get a list of all relevant governance rules over a scope.

SELECT
id,
name,
conditionSets,
description,
displayName,
excludedScopes,
governanceEmailNotification,
includeMemberScopes,
isDisabled,
isGracePeriod,
metadata,
ownerSource,
remediationTimeframe,
rulePriority,
ruleType,
sourceResourceType,
systemData,
tenantId,
type
FROM azure.security.governance_rules
WHERE scope = '{{ scope }}' -- required
;

INSERT examples

create_or_update

Creates or updates a governance rule over a given scope.

INSERT INTO azure.security.governance_rules (
properties,
scope,
rule_id
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ rule_id }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: governance_rules
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the governance_rules resource.
  - name: rule_id
    value: "{{ rule_id }}"
    description: Required parameter for the governance_rules resource.
  - name: properties
    description: |
      Properties of a governance rule.
    value:
      tenantId: "{{ tenantId }}"
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      remediationTimeframe: "{{ remediationTimeframe }}"
      isGracePeriod: {{ isGracePeriod }}
      rulePriority: {{ rulePriority }}
      isDisabled: {{ isDisabled }}
      ruleType: "{{ ruleType }}"
      sourceResourceType: "{{ sourceResourceType }}"
      excludedScopes:
        - "{{ excludedScopes }}"
      conditionSets: "{{ conditionSets }}"
      includeMemberScopes: {{ includeMemberScopes }}
      ownerSource:
        type: "{{ type }}"
        value: "{{ value }}"
      governanceEmailNotification:
        disableManagerEmailNotification: {{ disableManagerEmailNotification }}
        disableOwnerEmailNotification: {{ disableOwnerEmailNotification }}
      metadata:
        createdBy: "{{ createdBy }}"
        createdOn: "{{ createdOn }}"
        updatedBy: "{{ updatedBy }}"
        updatedOn: "{{ updatedOn }}"

REPLACE examples

create_or_update

Creates or updates a governance rule over a given scope.

REPLACE azure.security.governance_rules
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND rule_id = '{{ rule_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Delete a Governance rule over a given scope.

DELETE FROM azure.security.governance_rules
WHERE scope = '{{ scope }}' --required
AND rule_id = '{{ rule_id }}' --required
;

Lifecycle Methods

execute

Execute a governance rule.

EXEC azure.security.governance_rules.execute 
@scope='{{ scope }}' --required, 
@rule_id='{{ rule_id }}' --required 
@@json=
'{
"override": {{ override }}
}'
;

operation_results

Get governance rules long run operation result for the requested scope by ruleId and operationId.

EXEC azure.security.governance_rules.operation_results 
@scope='{{ scope }}' --required, 
@rule_id='{{ rule_id }}' --required, 
@operation_id='{{ operation_id }}' --required
;