Add ai foundry policies, various bug fixes (#20)

* udpate category and add cognitive service policy

* Add new policies for Cognitive Services and update existing diagnostic settings

Co-authored-by: Copilot <copilot@github.com>

* Refactor workflow configuration for clarity and consistency in policy initiatives

Co-authored-by: Copilot <copilot@github.com>

* Add Azure Cosmos DB policies and assignments for security compliance

Co-authored-by: Copilot <copilot@github.com>

* Refactor diagnostic settings policies to use parameterized log and metric enabling

- Updated multiple diagnostic settings JSON files to replace hardcoded values for logs and metrics enabling with parameters.
- Introduced a new parameter `DS-008_LogsToEnable` to specify which logs should be enabled.
- Modified existence conditions to check for the count of enabled logs under the category group "allLogs".
- Ensured consistency across various resource types in the policy definitions for better maintainability and flexibility.

Co-authored-by: Copilot <copilot@github.com>

* Fix policy name and update display name for AppInsights diagnostic settings deployment

* Refactor Cosmos DB diagnostic settings to consolidate log categories under 'allLogs'

* Fix profileName value in diagnostic settings policies for consistency

* Update AzPolicyTest module version to 3.0.0 and improve action.yml formatting

* Update AzPolicyTest module version to 3.1.0 in pipeline templates

* Update policy assignment and definition resources to use 2026-01-01-preview API version

* Update policy assignment, definition, exemption, and set definition resources to use 2025-12-01-preview API version

* Update policy module versions to 3.1.0 and set action group policy versions to 1.0.0

* Remove version property from multiple policy definition files

* Update AzPolicyTest module version to 3.1.1 in pipeline templates

* Add PEDNS-016 effect for Cognitive Service Accounts to policy initiative

* Update policy definitions and assignments to use 2026-01-01-preview API version

* Update policy assignments and definitions to use 2025-12-01-preview API version

* Update policy definition references for Cosmos DB initiative and remove deprecated source built-in name

* Update policy definition reference for COSMOS-007 to use new policy ID

* Add allowed locations for COSMOS-007 and update integration test templates for Cosmos DB policies

* Add PEDNS-017 effect and update integration tests for Azure Cosmos DB policies

* Update minimalTlsVersion formatting in Cosmos DB policy templates for consistency

* Update policy definition groups and clean up deprecated entries in Cosmos DB policy initiative

* Refactor policy definitions for Cognitive Services: update field references and add new policy initiative

* Add new policy definitions and assignments for Cognitive Services: restrict model formats and names

* Update Azure Cognitive Services policy assignments: modify effects and add allowed formats and names

* Update modelFormat structure in policy definitions for Cognitive Services

* Rename allowedFormats and allowedNames parameters to listOfAllowedFormats and listOfAllowedNames in policy assignments and initiatives for consistency

* Add integration tests and configuration for Cognitive Services policies

* Update resource identifiers in Azure Private Endpoint DNS Records policy initiative

* Update storage account API version to 2025-08-01 in integration test templates

* Remove unused variable resourceSubnetName from cognitive service test template

* Enhance Cosmos DB policy to include capability checks and update policy definition reference

* Refactor Cognitive Services policy assignments to update allowed model names and enhance test templates

* Refactor policy rule in Cosmos DB audit policy to check for capabilities count instead of existence

* Add unique suffix to Cognitive Service account names in test templates

* Update Cognitive Services and Cosmos DB resource definitions to use latest API versions and remove unnecessary parameters

* Update COSMOS-001 Effect to Modify in Cosmos DB policy assignments and initiative

* Update identity to SystemAssigned and modify roleDefinitionIds in Cosmos DB policy assignments

* Update COSMOS-001 Effect to Modify in Cosmos DB policy definitions and tests

* Update identity to SystemAssigned and add roleDefinitionIds in Cognitive Services and Cosmos DB policy assignments; modify policy initiative effects and test templates

* Update COG-001 Effect to Modify in both dev and prod Cognitive Services policy assignments

* Update allowed names and resource references in Cognitive Services policy assignments and tests

* Update COG-004 Effect to Audit and modify allowed names in Cognitive Services policy assignments and tests

* Update workflow triggers and format in policy-initiatives.yml; modify defaultValue in polset-diag-settings.json

---------

Co-authored-by: Copilot <copilot@github.com>

Author: taoyangcloud

.azuredevops/templates/template-stage-policy-tests.yml

@@ -62,7 +62,7 @@ stages:
         - template: ./template-task-install-ps-modules.yml
           parameters:
             displayName: "Install AzPolicyTest Module"
-            moduleNames: "AzPolicyTest`@2.8.2"
+            moduleNames: "AzPolicyTest`@3.1.1"
             shouldInstall: ${{ or(eq(parameters.runPolicyJsonPesterTests, true), eq(parameters.runPolicyInitiativePesterTests, true), eq(parameters.runPolicyDefinitionPesterTests, true)) }}
 
         - pwsh: |

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Documentation
-    url: https://github.com/AzPolicyFactory/AzPolicyFactory/tree/main/docs
+    url: https://github.com/Azure/AzPolicyFactory/tree/main/docs
     about: Check the documentation before opening an issue

.github/actions/templates/test-policy-def/action.yml

@@ -1,5 +1,6 @@
 name: "Policy Definition Pester Tests"
-description: "Runs Pester tests for Azure Policy Definitions, Initiatives, and JSON content using the AzPolicyTest module"
+description: "Runs Pester tests for Azure Policy Definitions, Initiatives, and
+  JSON content using the AzPolicyTest module"
 author: "Tao Yang"
 
 inputs:
@@ -41,7 +42,9 @@ runs:
   using: "composite"
   steps:
     - name: Install AzPolicyTest Module
-      if: inputs.run-policy-json-pester-tests == 'true' || inputs.run-policy-initiative-pester-tests == 'true' || inputs.run-policy-definition-pester-tests == 'true'
+      if: inputs.run-policy-json-pester-tests == 'true' ||
+        inputs.run-policy-initiative-pester-tests == 'true' ||
+        inputs.run-policy-definition-pester-tests == 'true'
       shell: pwsh
       env:
         INPUT_WORKSPACE_DIRECTORY: ${{ github.workspace }}
@@ -50,7 +53,7 @@ runs:
         Write-Output '::group::Install AzPolicyTest Module'
         $scriptPath = "$env:INPUT_WORKSPACE_DIRECTORY/scripts/pipelines/pipeline-install-moduleFromRepo.ps1"
         & $scriptPath `
-          -modules 'AzPolicyTest@2.8.2' `
+          -modules 'AzPolicyTest@3.1.1' `
           -repoName 'PSGallery' `
           -maxRetry 3 `
           -allowPrerelease 'false'

.github/workflows/policy-initiatives.yml

@@ -1,7 +1,8 @@
 name: policy-initiatives
 
 on:
-  workflow_dispatch: # allows a manual run from the UI
+  workflow_dispatch:
+    # allows a manual run from the UI
     inputs:
       debug:
         description: "Enable debug logging"
@@ -28,7 +29,9 @@ jobs:
   job_call_initiation:
     name: Initiation
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    if:
+      ${{ github.event.workflow_run.conclusion == 'success' || github.event_name
+      == 'workflow_dispatch' }}
     steps:
       - name: "Checkout"
         uses: actions/checkout@v6
@@ -79,7 +82,7 @@ jobs:
           definition-file-path: "${{env.definitionFileDirectory}}"
           template-file-directory: "${{env.templateFileDirectory}}"
           bicep-file-path: "${{env.templateFileDirectory}}/${{env.templateFileName}}"
-          bicep-variable-name: "policyInitiatives"
+          bicep-variable-name: "policySetDefinitions"
           build-artifact-name: "policy_set_bicep_dev"
 
   job_build_prod:
@@ -100,7 +103,7 @@ jobs:
           definition-file-path: "${{env.definitionFileDirectory}}"
           template-file-directory: "${{env.templateFileDirectory}}"
           bicep-file-path: "${{env.templateFileDirectory}}/${{env.templateFileName}}"
-          bicep-variable-name: "policyInitiatives"
+          bicep-variable-name: "policySetDefinitions"
           build-artifact-name: "policy_set_bicep_prod"
 
   job_test_dev:

.gitignore

@@ -418,4 +418,6 @@ FodyWeavers.xsd
 *.msp
 
 #Mac
-.DS_Store
+.DS_Store
+.github/workflows/package.json
+.github/workflows/package-lock.json

.vscode/settings.json

@@ -54,5 +54,6 @@
     "unauthorized",
     "vnet",
     "whatif"
-  ]
+  ],
+  "sarif-viewer.connectToGithubCodeScanning": "off"
 }

bicep/modules/authorization/policy-assignment/management-group/main.bicep

@@ -32,7 +32,7 @@ var identityVar = policyAssignment.?identity == 'SystemAssigned'
         }
       : null
 
-resource assignment 'Microsoft.Authorization/policyAssignments@2025-03-01' = {
+resource assignment 'Microsoft.Authorization/policyAssignments@2025-12-01-preview' = {
   name: policyAssignment.name
   location: location
   properties: {

bicep/modules/authorization/policy-assignment/management-group/version.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "pathFilters": [
     "./main.json"
   ]

bicep/modules/authorization/policy-assignment/resource-group/main.bicep

@@ -35,7 +35,7 @@ var identityVar = policyAssignment.?identity == 'SystemAssigned'
         }
       : null
 
-resource assignment 'Microsoft.Authorization/policyAssignments@2025-03-01' = {
+resource assignment 'Microsoft.Authorization/policyAssignments@2025-12-01-preview' = {
   name: policyAssignment.name
   location: location
   properties: {

bicep/modules/authorization/policy-assignment/resource-group/version.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "pathFilters": [
     "./main.json"
   ]