Public/Publish-AzureDevopsGuestConfigurationPolicy.ps1
|
Function Publish-AzureDevopsGuestConfigurationPolicy{ [CmdletBinding()] Param( $PolicyConfigData ) Begin{ Write-Verbose "Intializing the function $($MyInvocation.MyCommand.Name)" $PipelinePolicyConfigdata = $PolicyConfigData $PolicyjsonData = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($PipelinePolicyConfigdata)) $PolicyDetails = $PolicyjsonData | ConvertFrom-Json } process{ Write-Verbose "Processing the policy configuration data" Foreach($PolicyDetail in $PolicyDetails){ If($PolicyDetail.ChangeType -ieq "delete, sourceRename" -or $PolicyDetail.ChangeType -ieq "delete"){ Write-Verbose "Configuration $($PolicyDetail.PolicyName), change type $($PolicyDetail.ChangeType). Getting the policy assignment details." $PolicyDefinition = Get-AzPolicyDefinition -Name $($PolicyDetail.PolicyName) $AllPolicySets = Get-AzPolicySetDefinition -Custom $PolicyUsage = $AllPolicySets | Where-Object { $_.PolicyDefinition.policyDefinitionId -ieq $PolicyDefinition.Id } if($PolicyUsage){ $PolicyUsage | ForEach-Object { Write-Verbose "The policy '$($PolicyDetail.PolicyName)' is part of the $($_.DisplayName) policy sets (initiatives). Performing the cleanup." $policyDefinitionIdToRemove = $PolicyDefinition.Id $updatedPolicyDefinitions = ConvertTo-Json $($_.policyDefinition | Where-Object { $_.policyDefinitionId -ine $policyDefinitionIdToRemove}) -Depth 20 Try{ Write-Verbose "Updating the policy initiative $($_.DisplayName) with updated list of policies." Set-AzPolicySetDefinition -Name $_.Name -DisplayName $_.DisplayName ` -Description $_.description -PolicyDefinition $updatedPolicyDefinitions ` -Parameter $_.parameters -Metadata $_.metadata } Catch{ Write-Error "An error occred while updating the initiative - $($_.DisplayName). Error - $($_.Exception.Message)." } try{ Write-Verbose "Removing the custom policy $($PolicyDetail.PolicyName) from Azure policies." Remove-AzPolicyDefinition -Id $policyDefinitionIdToRemove -Force } catch{ Write-Verbose "An error occured while removing the custom policy $($PolicyDetail.PolicyName) from Azure policies. Error $($_.Exception.Message)" } } } else{ Write-Verbose "The policy '$($PolicyDetail.PolicyName)' is not part of any policy sets (initiatives). Deleting the Policy." Remove-AzPolicyDefinition -Id $policyDefinitionIdToRemove -Force } } Else{ Write-Verbose "Configuration $($PolicyDetail.PolicyName), change type $($PolicyDetail.ChangeType). Creating the new policy definition." New-AzPolicyDefinition -Name "$($PolicyDetail.PolicyName)" -DisplayName "$($PolicyDetail.PolicyName)" -Policy $PolicyDetail.PolicyFilePath -Description "$($PolicyDetail.PolicyName).$($PolicyDetail.Version) - Machine Configuration Policy - ApplyandAutoCorrect " } } } } #END OF Publish-AzureDevopsGuestConfigurationPolicy |