diff --git a/rules/S6387/azureresourcemanager/highlighting.adoc b/rules/S6387/azureresourcemanager/highlighting.adoc new file mode 100644 index 0000000000..32e603e715 --- /dev/null +++ b/rules/S6387/azureresourcemanager/highlighting.adoc @@ -0,0 +1,8 @@ +=== Highlighting +==== JSON + +Highlight the relevant `$schema` property + +==== Bicep + +Highlight the relevant `targetScope` property diff --git a/rules/S6387/azureresourcemanager/rule.adoc b/rules/S6387/azureresourcemanager/rule.adoc index ee7bccac76..19868c96b7 100644 --- a/rules/S6387/azureresourcemanager/rule.adoc +++ b/rules/S6387/azureresourcemanager/rule.adoc @@ -6,6 +6,15 @@ include::../recommended.adoc[] == Sensitive Code Example +[source,bicep,diff-id=1,diff-type=noncompliant] +---- +targetScope = 'subscription' // Sensitive + +resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { + name: guid(subscription().id, 'exampleRoleAssignment') +} +---- + [source,json,diff-id=2,diff-type=noncompliant] ---- { @@ -23,7 +32,16 @@ include::../recommended.adoc[] == Compliant Solution -[source,json,diff-id=2,diff-type=compliant] +[source,bicep,diff-id=1,diff-type=compliant] +---- +targetScope = 'resourceGroup' + +resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { + name: guid(resourceGroup().id, 'exampleRoleAssignment') +} +---- + +[source,json,diff-id=2,diff-type=noncompliant] ---- { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -49,14 +67,6 @@ ifdef::env-github,rspecator-view[] include::../message.adoc[] -=== Highlighting -==== JSON - -Highlight the relevant `$schema` property - -==== Bicep - -Highlight the relevant `targetScope` property - +include::highlighting.adoc[] endif::env-github,rspecator-view[] \ No newline at end of file