Add policy set definition commands

azure-cli.pyproj

@@ -995,6 +995,7 @@
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\param-validation-params.json" />
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\param-validation-ref-params.json" />
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\param-validation-template.json" />
+    <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\sample_policy_set.json" />
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\sample_policy_rule.json" />
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\simple_deploy.json" />
     <Content Include="command_modules\azure-cli-resource\azure\cli\command_modules\resource\tests\simple_deploy_parameters.json" />

src/azure-cli-core/azure/cli/core/profiles/_shared.py

@@ -66,7 +66,7 @@ def __init__(self, import_prefix, client_name):
         ResourceType.MGMT_RESOURCE_FEATURES: '2015-12-01',
         ResourceType.MGMT_RESOURCE_LINKS: '2016-09-01',
         ResourceType.MGMT_RESOURCE_LOCKS: '2016-09-01',
-        ResourceType.MGMT_RESOURCE_POLICY: '2016-12-01',
+        ResourceType.MGMT_RESOURCE_POLICY: '2017-06-01-preview',
         ResourceType.MGMT_RESOURCE_RESOURCES: '2017-05-10',
         ResourceType.MGMT_RESOURCE_SUBSCRIPTIONS: '2016-06-01',
         ResourceType.DATA_STORAGE: '2017-04-17'

src/command_modules/azure-cli-acr/setup.py

@@ -31,7 +31,7 @@
 
 DEPENDENCIES = [
     'azure-cli-core',
-    'azure-mgmt-resource==1.2.0rc2',
+    'azure-mgmt-resource==1.2.0rc3',
     'azure-mgmt-storage==1.2.0',
     'azure-mgmt-containerregistry==0.3.1',
 ]

src/command_modules/azure-cli-network/setup.py

@@ -33,7 +33,7 @@
     'azure-mgmt-network==1.5.0rc3',
     'azure-mgmt-trafficmanager==0.30.0',
     'azure-mgmt-dns==1.0.1',
-    'azure-mgmt-resource==1.2.0rc2',
+    'azure-mgmt-resource==1.2.0rc3',
     'azure-cli-core',
     'mock'
 ]

src/command_modules/azure-cli-resource/HISTORY.rst

@@ -6,6 +6,8 @@ Release History
 +++++++++++++++++++
 * policy: support to show built-in policy definition.
 * policy: support mode parameter for creating policy definitions.
+* policy: add policy set definition commands.
+* policy: add sku and policysetdefinition parameters when creating policy assignment
 * managedapp definition: support to create managedapp definition using create-ui-definition and main-template.
 * BREAKING CHANGE: managedapp: Update to latest ARM package, which includes changing resource type from appliances to applications and applianceDefinitions to applicationDefinitions.
 

src/command_modules/azure-cli-resource/azure/cli/command_modules/resource/_client_factory.py

@@ -78,6 +78,10 @@ def cf_policy_definitions(_):
     return _resource_policy_client_factory().policy_definitions
 
 
+def cf_policy_set_definitions(_):
+    return _resource_policy_client_factory().policy_set_definitions
+
+
 def cf_management_locks(_):
     return _resource_lock_client_factory().management_locks
 

src/command_modules/azure-cli-resource/azure/cli/command_modules/resource/_help.py

@@ -172,7 +172,7 @@
                                 }
                             }
                         }
-            """
+"""
 helps['policy definition delete'] = """
     type: command
     short-summary: Delete a policy definition.
@@ -189,6 +189,43 @@
     type: command
     short-summary: List policy definitions.
 """
+helps['policy set-definition'] = """
+    type: group
+    short-summary: Manage resource policy set definitions.
+"""
+helps['policy set-definition create'] = """
+            type: command
+            short-summary: Create a policy set definition.
+            parameters:
+                - name: --definitions
+                  type: string
+                  short-summary: Policy definitions in JSON format, or a path to a file containing JSON rules.
+            examples:
+                - name: Create a policy set definition.
+                  text: |
+                    az policy setdefinition create -n readOnlyStorage --definitions \\
+                        [ \\
+                            { \\
+                                "policyDefinitionId": "/subscriptions/mySubId/providers/Microsoft.Authorization/policyDefinitions/storagePolicy" \\
+                            } \\
+                        ]
+"""
+helps['policy set-definition delete'] = """
+    type: command
+    short-summary: Delete a policy set definition.
+"""
+helps['policy set-definition show'] = """
+    type: command
+    short-summary: get a policy set definition.
+"""
+helps['policy set-definition update'] = """
+    type: command
+    short-summary: Update a policy set definition.
+"""
+helps['policy set-definition list'] = """
+    type: command
+    short-summary: List policy set definitions.
+"""
 helps['policy assignment'] = """
     type: group
     short-summary: Manage resource policy assignments.

src/command_modules/azure-cli-resource/azure/cli/command_modules/resource/_params.py

@@ -14,8 +14,9 @@
 from azure.cli.core.commands.parameters import (ignore_type, resource_group_name_type, tag_type,
                                                 tags_type, get_resource_group_completion_list,
                                                 enum_choice_list, no_wait_type, file_type)
-from .custom import (get_policy_completion_list, get_policy_assignment_completion_list,
-                     get_resource_types_completion_list, get_providers_completion_list)
+from .custom import (get_policy_completion_list, get_policy_set_completion_list,
+                     get_policy_assignment_completion_list, get_resource_types_completion_list,
+                     get_providers_completion_list)
 from ._validators import process_deployment_create_namespace, validate_lock_parameters
 
 
@@ -77,7 +78,6 @@
                             help='mode of the new policy definition.',
                             **enum_choice_list(PolicyMode))
 
-
 register_cli_argument('policy definition', 'display_name', help='display name of policy definition')
 register_cli_argument('policy definition', 'description', help='description of policy definition')
 register_cli_argument('policy assignment', 'name', options_list=('--name', '-n'), completer=get_policy_assignment_completion_list, help='name of the assignment')
@@ -87,10 +87,28 @@
     c.register_cli_argument('policy assignment create', 'params', options_list=('--params', '-p'),
                             help='JSON formatted string or path to file with parameter values of policy rule')
 
+with VersionConstraint(ResourceType.MGMT_RESOURCE_POLICY, min_api='2017-06-01-preview') as c:
+    existing_policy_set_definition_name_type = CliArgumentType(options_list=('--name', '-n'), completer=get_policy_set_completion_list, help='The policy set definition name')
+    c.register_cli_argument('policy set-definition', 'policy_set_definition_name', arg_type=existing_policy_set_definition_name_type)
+    c.register_cli_argument('policy set-definition create', 'name', options_list=('--name', '-n'), help='name of the new policy set definition')
+    c.register_cli_argument('policy set-definition', 'display_name', help='display name of policy set definition')
+    c.register_cli_argument('policy set-definition', 'description', help='description of policy set definition')
+    c.register_cli_argument('policy set-definition', 'params',
+                            help='JSON formatted string or a path to a file or uri with parameter definitions',
+                            type=file_type, completer=FilesCompleter())
+    c.register_cli_argument('policy set-definition', 'definitions',
+                            help='JSON formatted string or a path to a file or uri with such content',
+                            type=file_type, completer=FilesCompleter())
+    c.register_cli_argument('policy assignment create', 'policy_set_definition', options_list=('--policy-set-definition', '-d'),
+                            help='name or id of the policy set definition.')
+    c.register_cli_argument('policy assignment create', 'sku', options_list=('--sku', '-s'),
+                            help='policy sku.', **enum_choice_list(['free', 'standard']))
+    c.register_cli_argument('policy assignment create', 'notscopes', options_list=('--not-scopes'), nargs='+')
+
 register_cli_argument('policy assignment', 'scope', help='scope at which this policy assignment applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM')
 register_cli_argument('policy assignment', 'disable_scope_strict_match', action='store_true', help='include assignment either inhertied from parent scope or at child scope')
 register_cli_argument('policy assignment', 'display_name', help='display name of the assignment')
-register_cli_argument('policy assignment', 'policy', help='policy name or fully qualified id', completer=get_policy_completion_list)
+register_cli_argument('policy assignment', 'policy', help='name or id of the policy definition.', completer=get_policy_completion_list)
 
 register_cli_argument('group', 'tag', tag_type)
 register_cli_argument('group', 'tags', tags_type)

src/command_modules/azure-cli-resource/azure/cli/command_modules/resource/commands.py

@@ -21,6 +21,7 @@
                                                                 cf_deployments,
                                                                 cf_deployment_operations,
                                                                 cf_policy_definitions,
+                                                                cf_policy_set_definitions,
                                                                 cf_resource_links,
                                                                 cf_resource_managedapplications,
                                                                 cf_resource_managedappdefinitions)
@@ -124,6 +125,13 @@ def transform_deployments_list(result):
 cli_command(__name__, 'policy definition show', 'azure.cli.command_modules.resource.custom#get_policy_definition', exception_handler=empty_on_404)
 cli_command(__name__, 'policy definition update', 'azure.cli.command_modules.resource.custom#update_policy_definition')
 
+if supported_api_version(ResourceType.MGMT_RESOURCE_POLICY, min_api='2017-06-01-preview'):
+    cli_command(__name__, 'policy set-definition create', 'azure.cli.command_modules.resource.custom#create_policy_setdefinition')
+    cli_command(__name__, 'policy set-definition delete', 'azure.mgmt.resource.policy.operations#PolicySetDefinitionsOperations.delete', cf_policy_set_definitions)
+    cli_command(__name__, 'policy set-definition list', 'azure.mgmt.resource.policy.operations#PolicySetDefinitionsOperations.list', cf_policy_set_definitions)
+    cli_command(__name__, 'policy set-definition show', 'azure.cli.command_modules.resource.custom#get_policy_setdefinition', exception_handler=empty_on_404)
+    cli_command(__name__, 'policy set-definition update', 'azure.cli.command_modules.resource.custom#update_policy_setdefinition')
+
 cli_command(__name__, 'lock create', 'azure.cli.command_modules.resource.custom#create_lock')
 cli_command(__name__, 'lock delete', 'azure.cli.command_modules.resource.custom#delete_lock')
 cli_command(__name__, 'lock list', 'azure.cli.command_modules.resource.custom#list_locks')

src/command_modules/azure-cli-resource/azure/cli/command_modules/resource/custom.py

@@ -690,12 +690,20 @@ def list_features(client, resource_provider_namespace=None):
     return client.list_all()
 
 
-def create_policy_assignment(policy, name=None, display_name=None, params=None,
-                             resource_group_name=None, scope=None):
+def create_policy_assignment(policy=None, policy_set_definition=None,
+                             name=None, display_name=None, params=None,
+                             resource_group_name=None, scope=None, sku=None,
+                             not_scopes=None):
+    """Creates a policy assignment
+    :param not_scopes: Space separated scopes where the policy assignment does not apply.
+    """
+    if bool(policy) == bool(policy_set_definition):
+        raise CLIError('usage error: --policy NAME_OR_ID | \
+        --policy-set-definition NAME_OR_ID')
     policy_client = _resource_policy_client_factory()
     scope = _build_policy_scope(policy_client.config.subscription_id,
                                 resource_group_name, scope)
-    policy_id = _resolve_policy_id(policy, policy_client)
+    policy_id = _resolve_policy_id(policy, policy_set_definition, policy_client)
 
     if params:
         if os.path.exists(params):
@@ -704,7 +712,26 @@ def create_policy_assignment(policy, name=None, display_name=None, params=None,
             params = shell_safe_json_parse(params)
 
     PolicyAssignment = get_sdk(ResourceType.MGMT_RESOURCE_POLICY, 'PolicyAssignment', mod='models')
-    assignment = PolicyAssignment(display_name, policy_id, scope, params if params else None)
+    assignment = PolicyAssignment(display_name, policy_id, scope)
+    assignment.parameters = params if params else None
+
+    if supported_api_version(ResourceType.MGMT_RESOURCE_POLICY, min_api='2017-06-01-preview'):
+        if not_scopes:
+            kwargs_list = []
+            for id_arg in not_scopes.split(' '):
+                if parse_resource_id(id_arg):
+                    kwargs_list.append(id_arg)
+                else:
+                    logger.error('az policy assignment create error: argument --not-scopes: \
+                    invalid notscopes value: \'%s\'' % id_arg)
+                    return
+            assignment.not_scopes = kwargs_list
+        PolicySku = get_sdk(ResourceType.MGMT_RESOURCE_POLICY, 'PolicySku', mod='models')
+        policySku = PolicySku('A0', 'Free')
+        if sku:
+            policySku = policySku if sku.lower() == 'free' else PolicySku('A1', 'Standard')
+        assignment.sku = policySku
+
     return policy_client.policy_assignments.create(scope,
                                                    name or uuid.uuid4(),
                                                    assignment)
@@ -774,11 +801,15 @@ def _build_policy_scope(subscription_id, resource_group_name, scope):
     return scope
 
 
-def _resolve_policy_id(policy, client):
-    policy_id = policy
-    if not is_valid_resource_id(policy):
-        policy_def = client.policy_definitions.get(policy)
-        policy_id = policy_def.id
+def _resolve_policy_id(policy, policy_set_definition, client):
+    policy_id = policy or policy_set_definition
+    if not is_valid_resource_id(policy_id):
+        if policy:
+            policy_def = client.policy_definitions.get(policy)
+            policy_id = policy_def.id
+        else:
+            policy_set_def = client.policy_set_definitions.get(policy_set_definition)
+            policy_id = policy_set_def.id
     return policy_id
 
 
@@ -812,6 +843,17 @@ def create_policy_definition(name, rules=None, params=None, display_name=None, d
     return policy_client.policy_definitions.create_or_update(name, parameters)
 
 
+def create_policy_setdefinition(name, definitions, params=None, display_name=None, description=None):
+    definitions = _load_file_string_or_uri(definitions, 'definitions')
+    params = _load_file_string_or_uri(params, 'params', False)
+
+    policy_client = _resource_policy_client_factory()
+    PolicySetDefinition = get_sdk(ResourceType.MGMT_RESOURCE_POLICY, 'PolicySetDefinition', mod='models')
+    parameters = PolicySetDefinition(policy_definitions=definitions, parameters=params, description=description,
+                                     display_name=display_name)
+    return policy_client.policy_set_definitions.create_or_update(name, parameters)
+
+
 def get_policy_definition(policy_definition_name):
     from msrestazure.azure_exceptions import CloudError
     policy_client = _resource_policy_client_factory()
@@ -826,6 +868,20 @@ def get_policy_definition(policy_definition_name):
         raise
 
 
+def get_policy_setdefinition(policy_set_definition_name):
+    from msrestazure.azure_exceptions import CloudError
+    policy_client = _resource_policy_client_factory()
+    try:
+        return policy_client.policy_set_definitions.get(policy_set_definition_name)
+    except CloudError as ex:
+        if ex.status_code == 404:
+            # work around for https://github.com/Azure/azure-cli/issues/692
+            policy_id = '/providers/Microsoft.Authorization/policysetdefinitions/' + policy_set_definition_name
+            rcf = _resource_client_factory()
+            return rcf.resources.get_by_id(policy_id, policy_client.policy_set_definitions.api_version)
+        raise
+
+
 def update_policy_definition(policy_definition_name, rules=None, params=None,
                              display_name=None, description=None):
     if rules:
@@ -852,12 +908,44 @@ def update_policy_definition(policy_definition_name, rules=None, params=None,
     return policy_client.policy_definitions.create_or_update(policy_definition_name, parameters)
 
 
+def update_policy_setdefinition(policy_set_definition_name, definitions=None, params=None,
+                                display_name=None, description=None):
+    if definitions:
+        if os.path.exists(definitions):
+            definitions = get_file_json(definitions)
+        else:
+            definitions = shell_safe_json_parse(definitions)
+
+    if params:
+        if os.path.exists(params):
+            params = get_file_json(params)
+        else:
+            params = shell_safe_json_parse(params)
+
+    policy_client = _resource_policy_client_factory()
+    definition = policy_client.policy_set_definitions.get(policy_set_definition_name)
+    # pylint: disable=line-too-long,no-member
+    PolicySetDefinition = get_sdk(ResourceType.MGMT_RESOURCE_POLICY, 'PolicySetDefinition', mod='models')
+    parameters = PolicySetDefinition(
+        policy_definitions=definitions if definitions is not None else definition.policy_definitions,
+        description=description if description is not None else definition.description,
+        display_name=display_name if display_name is not None else definition.display_name,
+        parameters=params if params is not None else definition.parameters)
+    return policy_client.policy_set_definitions.create_or_update(policy_set_definition_name, parameters)
+
+
 def get_policy_completion_list(prefix, **kwargs):  # pylint: disable=unused-argument
     policy_client = _resource_policy_client_factory()
     result = policy_client.policy_definitions.list()
     return [i.name for i in result]
 
 
+def get_policy_set_completion_list(prefix, **kwargs):  # pylint: disable=unused-argument
+    policy_client = _resource_policy_client_factory()
+    result = policy_client.policy_set_definitions.list()
+    return [i.name for i in result]
+
+
 def get_policy_assignment_completion_list(prefix, **kwargs):  # pylint: disable=unused-argument
     policy_client = _resource_policy_client_factory()
     result = policy_client.policy_assignments.list()