output/20260723_082108/govviz/repo/pwsh/dev/functions/cacheBuiltIn.ps1
|
function cacheBuiltIn { $startDefinitionsCaching = Get-Date Write-Host 'Caching built-in Policy and RBAC Role definitions' $arrayBuiltInCaching = @('PolicyDefinitions', 'PolicyDefinitionsStatic', 'PolicySetDefinitions', 'RoleDefinitions') $arrayBuiltInCaching | ForEach-Object -Parallel { $builtInCapability = $_ #fromOtherFunctions $azAPICallConf = $using:azAPICallConf $scriptPath = $using:ScriptPath #Array&HTs $htCacheDefinitionsPolicy = $using:htCacheDefinitionsPolicy $htCacheDefinitionsPolicySet = $using:htCacheDefinitionsPolicySet $htCacheDefinitionsRole = $using:htCacheDefinitionsRole $ValidPolicyEffects = $using:ValidPolicyEffects $htHashesBuiltInPolicy = $using:htHashesBuiltInPolicy #vars $ARMLocation = $using:ARMLocation $ignoreARMLocation = $using:ignoreARMLocation #functions $function:detectPolicyEffect = $using:funcDetectPolicyEffect $function:getPolicyHash = $using:funcGetPolicyHash if ($builtInCapability -eq 'PolicyDefinitions') { $currentTask = 'Caching built-in Policy definitions' Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Authorization/policyDefinitions?api-version=2021-06-01&`$filter=policyType eq 'BuiltIn'" $method = 'GET' $requestPolicyDefinitionAPI = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask Write-Host " $($requestPolicyDefinitionAPI.Count) built-in Policy definitions returned" $builtinPolicyDefinitions = $requestPolicyDefinitionAPI.where( { $_.properties.policyType -eq 'BuiltIn' } ) foreach ($builtinPolicyDefinition in $builtinPolicyDefinitions) { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()) = @{ Id = ($builtinPolicyDefinition.Id).ToLower() ScopeMGLevel = '' Scope = 'n/a' ScopeMgSub = 'n/a' ScopeId = 'n/a' DisplayName = $builtinPolicyDefinition.Properties.displayname Name = $builtinPolicyDefinition.Name Description = $builtinPolicyDefinition.Properties.description Type = $builtinPolicyDefinition.Properties.policyType Category = $builtinPolicyDefinition.Properties.metadata.category Version = $builtinPolicyDefinition.Properties.metadata.version PolicyDefinitionId = ($builtinPolicyDefinition.Id).ToLower() LinkToAzAdvertizer = "<a class=`"externallink`" href=`"https://www.azadvertizer.net/azpolicyadvertizer/$(($builtinPolicyDefinition.Id -replace '.*/')).html`" target=`"_blank`" rel=`"noopener`">$($builtinPolicyDefinition.Properties.displayname)</a>" ALZ = $false ALZState = '' ALZLatestVer = '' ALZIdentificationLevel = '' ALZPolicyName = '' } if ($builtinPolicyDefinition.Properties.metadata.deprecated -eq $true -or $builtinPolicyDefinition.Properties.displayname -like "``[Deprecated``]*") { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).Deprecated = $builtinPolicyDefinition.Properties.metadata.deprecated } else { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).Deprecated = $false } if ($builtinPolicyDefinition.Properties.metadata.preview -eq $true -or $builtinPolicyDefinition.Properties.displayname -like "``[*Preview``]*") { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).Preview = $builtinPolicyDefinition.Properties.metadata.preview } else { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).Preview = $false } #region effect $htEffectDetected = detectPolicyEffect -policyDefinition $builtinPolicyDefinition $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).effectDefaultValue = $htEffectDetected.defaultValue $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).effectAllowedValue = $htEffectDetected.allowedValues $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).effectFixedValue = $htEffectDetected.fixedValue #endregion effect $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).Json = $builtinPolicyDefinition if (-not [string]::IsNullOrWhiteSpace($builtinPolicyDefinition.properties.policyRule.then.details.roleDefinitionIds)) { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).RoleDefinitionIds = $builtinPolicyDefinition.properties.policyRule.then.details.roleDefinitionIds } else { $script:htCacheDefinitionsPolicy.(($builtinPolicyDefinition.Id).ToLower()).RoleDefinitionIds = 'n/a' } #hashes for parity builtin/custom # $script:htHashesBuiltInPolicy.(($builtinPolicyDefinition.Id).ToLower()) = @{ # policyRuleHash = getPolicyHash -object ($builtinPolicyDefinition.properties.policyRule | ConvertTo-Json -Depth 99) # } $policyRuleHash = (getPolicyHash -json ($builtinPolicyDefinition.properties.policyRule | ConvertTo-Json -Depth 99)) if (-not $htHashesBuiltInPolicy.($policyRuleHash)) { $script:htHashesBuiltInPolicy.($policyRuleHash) = @{ Policies = [System.Collections.ArrayList]@() } $null = $script:htHashesBuiltInPolicy.($policyRuleHash).Policies.Add(($builtinPolicyDefinition.Id).ToLower()) } else { #Write-Host "$($builtinPolicyDefinition.name) $($policyRuleHash) already exists" $null = $script:htHashesBuiltInPolicy.($policyRuleHash).Policies.Add(($builtinPolicyDefinition.Id).ToLower()) #$htHashesBuiltInPolicy.($policyRuleHash).Policies.Count } } Write-Host " $($htHashesBuiltInPolicy.Keys.Count) unique Policy rule hashes for built-in Policy definitions" } if ($builtInCapability -eq 'PolicyDefinitionsStatic') { $currentTask = 'Caching static Policy definitions' Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Authorization/policyDefinitions?api-version=2021-06-01&`$filter=policyType eq 'Static'" $method = 'GET' $requestPolicyDefinitionAPI = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask Write-Host " $($requestPolicyDefinitionAPI.Count) static Policy definitions returned" $staticPolicyDefinitions = $requestPolicyDefinitionAPI.where( { $_.properties.policyType -eq 'Static' } ) foreach ($staticPolicyDefinition in $staticPolicyDefinitions) { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()) = @{ Id = ($staticPolicyDefinition.Id).ToLower() ScopeMGLevel = '' Scope = 'n/a' ScopeMgSub = 'n/a' ScopeId = 'n/a' DisplayName = $staticPolicyDefinition.Properties.displayname Name = $staticPolicyDefinition.Name Description = $staticPolicyDefinition.Properties.description Type = $staticPolicyDefinition.Properties.policyType Category = $staticPolicyDefinition.Properties.metadata.category Version = $staticPolicyDefinition.Properties.metadata.version PolicyDefinitionId = ($staticPolicyDefinition.Id).ToLower() LinkToAzAdvertizer = "<a class=`"externallink`" href=`"https://www.azadvertizer.net/azpolicyadvertizer/$(($staticPolicyDefinition.Id -replace '.*/')).html`" target=`"_blank`" rel=`"noopener`">$($staticPolicyDefinition.Properties.displayname)</a>" ALZ = $false ALZState = '' ALZLatestVer = '' ALZIdentificationLevel = '' ALZPolicyName = '' } if ($staticPolicyDefinition.Properties.metadata.deprecated -eq $true -or $staticPolicyDefinition.Properties.displayname -like "``[Deprecated``]*") { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).Deprecated = $staticPolicyDefinition.Properties.metadata.deprecated } else { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).Deprecated = $false } if ($staticPolicyDefinition.Properties.metadata.preview -eq $true -or $staticPolicyDefinition.Properties.displayname -like "``[*Preview``]*") { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).Preview = $staticPolicyDefinition.Properties.metadata.preview } else { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).Preview = $false } #region effect $htEffectDetected = detectPolicyEffect -policyDefinition $staticPolicyDefinition $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).effectDefaultValue = $htEffectDetected.defaultValue $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).effectAllowedValue = $htEffectDetected.allowedValues $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).effectFixedValue = $htEffectDetected.fixedValue #endregion effect $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).Json = $staticPolicyDefinition if (-not [string]::IsNullOrWhiteSpace($staticPolicyDefinition.properties.policyRule.then.details.roleDefinitionIds)) { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).RoleDefinitionIds = $staticPolicyDefinition.properties.policyRule.then.details.roleDefinitionIds } else { $script:htCacheDefinitionsPolicy.(($staticPolicyDefinition.Id).ToLower()).RoleDefinitionIds = 'n/a' } } } if ($builtInCapability -eq 'PolicySetDefinitions') { $currentTask = 'Caching built-in PolicySet definitions' Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Authorization/policySetDefinitions?api-version=2021-06-01&`$filter=policyType eq 'BuiltIn'" $method = 'GET' $requestPolicySetDefinitionAPI = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask $builtinPolicySetDefinitions = $requestPolicySetDefinitionAPI.where( { $_.properties.policyType -eq 'BuiltIn' } ) Write-Host " $($requestPolicySetDefinitionAPI.Count) built-in PolicySet definitions returned" foreach ($builtinPolicySetDefinition in $builtinPolicySetDefinitions) { $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()) = @{ Id = ($builtinPolicySetDefinition.Id).ToLower() ScopeMGLevel = '' Scope = 'n/a' ScopeMgSub = 'n/a' ScopeId = 'n/a' DisplayName = $builtinPolicySetDefinition.Properties.displayname Name = $builtinPolicySetDefinition.Name Description = $builtinPolicySetDefinition.Properties.description Type = $builtinPolicySetDefinition.Properties.policyType Category = $builtinPolicySetDefinition.Properties.metadata.category Version = $builtinPolicySetDefinition.Properties.metadata.version PolicyDefinitionId = ($builtinPolicySetDefinition.Id).ToLower() LinkToAzAdvertizer = "<a class=`"externallink`" href=`"https://www.azadvertizer.net/azpolicyinitiativesadvertizer/$(($builtinPolicySetDefinition.Id -replace '.*/')).html`" target=`"_blank`" rel=`"noopener`">$($builtinPolicySetDefinition.Properties.displayname)</a>" ALZ = $false ALZState = '' ALZLatestVer = '' ALZIdentificationLevel = '' ALZPolicySetName = '' } $htPolicySetPolicyRefIds = @{} $arrayPolicySetPolicyIdsToLower = foreach ($policySetPolicy in $builtinPolicySetDefinition.properties.policydefinitions) { ($policySetPolicy.policyDefinitionId).ToLower() $htPolicySetPolicyRefIds.($policySetPolicy.policyDefinitionReferenceId) = ($policySetPolicy.policyDefinitionId) } $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).PolicySetPolicyIds = $arrayPolicySetPolicyIdsToLower $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).PolicySetPolicyRefIds = $htPolicySetPolicyRefIds if ($builtinPolicySetDefinition.Properties.metadata.deprecated -eq $true -or $builtinPolicySetDefinition.Properties.displayname -like "``[Deprecated``]*") { $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).Deprecated = $builtinPolicySetDefinition.Properties.metadata.deprecated } else { $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).Deprecated = $false } if ($builtinPolicySetDefinition.Properties.metadata.preview -eq $true -or $builtinPolicySetDefinition.Properties.displayname -like "``[*Preview``]*") { $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).Preview = $builtinPolicySetDefinition.Properties.metadata.preview } else { $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).Preview = $false } $script:htCacheDefinitionsPolicySet.(($builtinPolicySetDefinition.Id).ToLower()).Json = $builtinPolicySetDefinition } } if ($builtInCapability -eq 'RoleDefinitions') { $roledefinitionsAPIVersion = $azAPICallConf['htParameters'].APIMappingCloudEnvironment.roledefinitions.($azAPICallConf['htParameters'].azureCloudEnvironment) #region subscriptionScope if ($ignoreARMLocation) { $currentTask = 'Caching built-in Role definitions (subscriptionScope)' Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls'].'ARM')/subscriptions/$($azAPICallConf['checkContext'].Subscription.Id)/providers/Microsoft.Authorization/roleDefinitions?api-version=$($roledefinitionsAPIVersion)&`$filter=type eq 'BuiltInRole'" } else { $currentTask = "Caching built-in Role definitions (Location: '$($ARMLocation)') (subscriptionScope)" Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls']."ARM$($ARMLocation)")/subscriptions/$($azAPICallConf['checkContext'].Subscription.Id)/providers/Microsoft.Authorization/roleDefinitions?api-version=$($roledefinitionsAPIVersion)&`$filter=type eq 'BuiltInRole'" } $method = 'GET' $requestRoleDefinitionAPI = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask Write-Host " $($requestRoleDefinitionAPI.Count) built-in Role definitions returned (subscriptionScope)" foreach ($roleDefinition in $requestRoleDefinitionAPI) { if ( ( $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/roleassignments/write' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/roleassignments/*' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/*/write' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/*' -or $roleDefinition.properties.permissions.actions -contains '*/write' -or $roleDefinition.properties.permissions.actions -contains '*' ) -and ( $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/roleassignments/write' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/roleassignments/*' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/*/write' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/*' -and $roleDefinition.properties.permissions.notActions -notcontains '*/write' -and $roleDefinition.properties.permissions.notActions -notcontains '*' ) ) { $roleCapable4RoleAssignmentsWrite = $true } else { $roleCapable4RoleAssignmentsWrite = $false } ($script:htCacheDefinitionsRole).($roleDefinition.name) = @{ Id = ($roleDefinition.name) Name = ($roleDefinition.properties.roleName) IsCustom = $false AssignableScopes = ($roleDefinition.properties.assignableScopes) Actions = ($roleDefinition.properties.permissions.actions) NotActions = ($roleDefinition.properties.permissions.notActions) DataActions = ($roleDefinition.properties.permissions.dataActions) NotDataActions = ($roleDefinition.properties.permissions.notDataActions) Json = $roleDefinition LinkToAzAdvertizer = "<a class=`"externallink`" href=`"https://www.azadvertizer.net/azrolesadvertizer/$($roleDefinition.name).html`" target=`"_blank`" rel=`"noopener`">$($roleDefinition.properties.roleName)</a>" RoleCanDoRoleAssignments = $roleCapable4RoleAssignmentsWrite } } #endregion subscriptionScope #region tenantScope if ($ignoreARMLocation) { $currentTask = 'Caching built-in Role definitions (tenantScope)' Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls'].'ARM')/providers/Microsoft.Authorization/roleDefinitions?api-version=$($roledefinitionsAPIVersion)&`$filter=type eq 'BuiltInRole'" } else { $currentTask = "Caching built-in Role definitions (Location: '$($ARMLocation)') (tenantScope)" Write-Host " $currentTask" $uri = "$($azAPICallConf['azAPIEndpointUrls']."ARM$($ARMLocation)")/providers/Microsoft.Authorization/roleDefinitions?api-version=$($roledefinitionsAPIVersion)&`$filter=type eq 'BuiltInRole'" } $method = 'GET' $requestRoleDefinitionTenantScopeAPI = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask Write-Host " $($requestRoleDefinitionTenantScopeAPI.Count) built-in Role definitions returned (tenantScope)" foreach ($roleDefinition in $requestRoleDefinitionTenantScopeAPI) { if (-not $htCacheDefinitionsRole.($roleDefinition.name)) { Write-Host "tenantScope role: '$($roleDefinition.properties.roleName)' - $($roleDefinition.name)" if ( ( $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/roleassignments/write' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/roleassignments/*' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/*/write' -or $roleDefinition.properties.permissions.actions -contains 'Microsoft.Authorization/*' -or $roleDefinition.properties.permissions.actions -contains '*/write' -or $roleDefinition.properties.permissions.actions -contains '*' ) -and ( $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/roleassignments/write' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/roleassignments/*' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/*/write' -and $roleDefinition.properties.permissions.notActions -notcontains 'Microsoft.Authorization/*' -and $roleDefinition.properties.permissions.notActions -notcontains '*/write' -and $roleDefinition.properties.permissions.notActions -notcontains '*' ) ) { $roleCapable4RoleAssignmentsWrite = $true } else { $roleCapable4RoleAssignmentsWrite = $false } ($script:htCacheDefinitionsRole).($roleDefinition.name) = @{ Id = ($roleDefinition.name) Name = ($roleDefinition.properties.roleName) IsCustom = $false AssignableScopes = ($roleDefinition.properties.assignableScopes) Actions = ($roleDefinition.properties.permissions.actions) NotActions = ($roleDefinition.properties.permissions.notActions) DataActions = ($roleDefinition.properties.permissions.dataActions) NotDataActions = ($roleDefinition.properties.permissions.notDataActions) Json = $roleDefinition LinkToAzAdvertizer = "<a class=`"externallink`" href=`"https://www.azadvertizer.net/azrolesadvertizer/$($roleDefinition.name).html`" target=`"_blank`" rel=`"noopener`">$($roleDefinition.properties.roleName)</a>" RoleCanDoRoleAssignments = $roleCapable4RoleAssignmentsWrite } } } #endregion tenantScope } } $script:builtInPolicyDefinitionsCount = $htCacheDefinitionsPolicy.Values.where({ $_.Type -eq 'BuiltIn' }).count $endDefinitionsCaching = Get-Date Write-Host "Caching built-in definitions duration: $((New-TimeSpan -Start $startDefinitionsCaching -End $endDefinitionsCaching).TotalSeconds) seconds" } |