The order of parameters in /Microsoft.GuestConfiguration/guestConfigurationAssignments properties.parameterHash is unclear if multiple resources defined in DSC configuration

Open
#307 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
powershell
Domain
cloud

Research direction

Start by reproducing the issue with New-GuestConfigurationPolicy -Parameter and DSC configurations containing one and multiple resources. Inspect how properties.parameterHash is assembled and compare its parameter order with the generated policy definition. Done means multiple-resource configurations produce a stable, matching order so the Azure Policy existenceCondition reports compliance.

Written by the indexing model from the issue text.

Description

I will summarize in short for those, who do not know.

The AzureRM resource /Microsoft.GuestConfiguration/guestConfigurationAssignments advertise the property properties.parameterHash. In Base 64 format it contains series of [ResourceType]ResourceId;ResourcePreoperty'=ResourceValue.

The New-GuestConfigurationPolicy generated Azure Policy definition which internally relies on this parameter. Example:

      "existenceCondition": {
        "allOf": [
          {
            "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
            "equals": "Compliant"
          },
          {
            "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
            "equals": "[base64(concat('[DSC_HardeningAuditpol]AuditpolInstance;BackupAuditpol', '=', parameters('AuditpolBackupAuditpol'), ',', '[DSC_HardeningAuditpol]AuditpolInstance;HardeningLevel', '=', parameters('AuditpolHardeningLevel'),

The order matters. Else the Policy will never show the compliance. New-GuestConfigurationPolicy -Parameter $PolicyParameterInfo where $PolicyParameterInfo should have propper order.

As per my tests:

  • if the DSC Configuraiton contains one reosurce, the paramaters in properties.parameterHash are in alphabetical order.
  • if the DSC Configuraiton contains multiple reosurce, the paramaters in properties.parameterHash are loosing order, at least i cannot identify it.

Has any one came across this issue?

My company requires automated solution to generate Azure Policies and currently this is blocker for me

Dominant language
PowerShell
Stars
8
Forks
13
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure/GuestConfiguration

All issues in Azure/GuestConfiguration

Similar issues

More Cloud issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.