Updating src deployment to handle policy rules

Author: EMaher

tests/integration/all-resource-types/Deploy-SourceApim.ps1

@@ -56,6 +56,7 @@ $ErrorActionPreference = 'Stop'
 $VerbosePreference = if ($LogLevel -in @('Verbose', 'Debug')) { 'Continue' } else { 'SilentlyContinue' }
 $DebugPreference   = if ($LogLevel -eq 'Debug') { 'Continue' } else { 'SilentlyContinue' }
 Import-Module (Join-Path $PSScriptRoot 'MaskingHelpers.psm1') -Force
+Import-Module (Join-Path $PSScriptRoot 'DeploymentHelpers.psm1') -Force
 
 # Map this script's LogLevel (Info/Verbose/Debug) to the apiops CLI log level
 # values used in the printed example command.
@@ -104,7 +105,8 @@ $requiredProviders = @(
     'Microsoft.Insights',
     'Microsoft.OperationalInsights',
     'Microsoft.EventHub',
-    'Microsoft.KeyVault'
+    'Microsoft.KeyVault',
+    'Microsoft.AlertsManagement'
 )
 foreach ($provider in $requiredProviders) {
     $state = az provider show --namespace $provider --query "registrationState" --output tsv 2>$null
@@ -175,15 +177,44 @@ $azArgs = @(
 
 $raw = Invoke-MaskedAzCommand -Replacements $azReplacements -Arguments $azArgs
 
-$result = $raw | ConvertFrom-Json
-
 if ($LASTEXITCODE -ne 0) {
-    Write-Error "Deployment failed. Check the Azure portal for details."
+    Write-DeploymentFailureDetails `
+        -ResourceGroupName $ResourceGroupName `
+        -DeploymentName    $deploymentName `
+        -Replacements      $azReplacements
+    throw "Source APIM deployment failed (deployment '$deploymentName' in resource group '$(Protect-ResourceGroupName -Value $ResourceGroupName)'). See failed-operation details above."
 }
 
+$result = $raw | ConvertFrom-Json
+
 # Extract outputs
 $outputs = $result.properties.outputs
 
+# policyRestriction is created here (not in Bicep) because scope validation needs the APIM data-plane to be active.
+$isClassicSku = $SkuName -in @('Developer', 'Premium')
+if ($isClassicSku) {
+    $apimServiceName = $outputs.apimServiceName.value
+    Wait-ApimActivation -ResourceGroupName $ResourceGroupName -ApimName $apimServiceName | Out-Null
+
+    $restrictionName = 'src-restriction-ip'
+    $productId       = 'src-product-starter'
+    $restrictionUrl  = "https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.ApiManagement/service/$apimServiceName/policyRestrictions/$restrictionName?api-version=2024-05-01"
+    $restrictionBody = (@{ properties = @{ scope = "/products/$productId"; requireBase = 'true' } } | ConvertTo-Json -Compress)
+
+    Write-Host "Creating policyRestriction '$restrictionName' (scope /products/$productId)..." -ForegroundColor Cyan
+    $putReplacements = $azReplacements.Clone()
+    $putReplacements[$apimServiceName] = Protect-ApimName -Value $apimServiceName
+    Invoke-MaskedProcess -FilePath 'az' -Replacements $putReplacements -Arguments @(
+        'rest', '--method', 'put',
+        '--url',  $restrictionUrl,
+        '--body', $restrictionBody
+    )
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to create policyRestriction '$restrictionName' on APIM '$(Protect-ApimName -Value $apimServiceName)'"
+    }
+    Write-Host "  policyRestriction created" -ForegroundColor Green
+}
+
 Write-Host ""
 Write-Host "============================================================" -ForegroundColor Green
 Write-Host "✅ Kitchen Sink APIM deployed successfully!" -ForegroundColor Green
@@ -194,7 +225,7 @@ Write-Host ""
 Write-Host "  npx apiops extract \"
 Write-Host "    --subscription-id $(Protect-SubscriptionId -Value $outputs.subscriptionId.value) \"
 Write-Host "    --resource-group  $(Protect-ResourceGroupName -Value $outputs.resourceGroupName.value) \"
-Write-Host "    --service-name    $($outputs.apimServiceName.value) \"
+Write-Host "    --service-name    $(Protect-ApimName -Value $outputs.apimServiceName.value) \"
 Write-Host "    --output-dir      ./extracted \"
 Write-Host "    --log-level       $apiopsLogLevel"
 Write-Host ""

tests/integration/all-resource-types/Deploy-TargetApim.ps1

@@ -40,6 +40,7 @@ $ErrorActionPreference = 'Stop'
 $VerbosePreference = if ($LogLevel -in @('Verbose', 'Debug')) { 'Continue' } else { 'SilentlyContinue' }
 $DebugPreference   = if ($LogLevel -eq 'Debug') { 'Continue' } else { 'SilentlyContinue' }
 Import-Module (Join-Path $PSScriptRoot 'MaskingHelpers.psm1') -Force
+Import-Module (Join-Path $PSScriptRoot 'DeploymentHelpers.psm1') -Force
 
 $bicepFile = Join-Path $PSScriptRoot 'target-apim.bicep'
 
@@ -79,10 +80,12 @@ $azReplacements = @{
     $ResourceGroupName = Protect-ResourceGroupName   -Value $ResourceGroupName
 }
 
+$deploymentName = "target-apim-$(Get-Date -Format 'yyyyMMddHHmmss')"
+
 $azArgs = @(
     'deployment', 'group', 'create',
     '--resource-group', $ResourceGroupName,
-    '--name',           "target-apim-$(Get-Date -Format 'yyyyMMddHHmmss')",
+    '--name',           $deploymentName,
     '--template-file',  $bicepFile,
     '--parameters',     "skuName=$SkuName", "location=$Location", "publisherEmail=$PublisherEmail",
     '--output',         'json'
@@ -91,14 +94,18 @@ $azArgs = @(
 $raw = Invoke-MaskedAzCommand -Replacements $azReplacements -Arguments $azArgs
 
 if ($LASTEXITCODE -ne 0) {
-    throw "Target APIM deployment failed"
+    Write-DeploymentFailureDetails `
+        -ResourceGroupName $ResourceGroupName `
+        -DeploymentName    $deploymentName `
+        -Replacements      $azReplacements
+    throw "Target APIM deployment failed (deployment '$deploymentName' in resource group '$(Protect-ResourceGroupName -Value $ResourceGroupName)'). See failed-operation details above."
 }
 
 $result = $raw | ConvertFrom-Json
 if (-not $result.properties.outputs) {
     throw "Target deployment returned no outputs"
 }
 
-Write-Host "✅ Target APIM deployed successfully: $($result.properties.outputs.apimServiceName.value)"
+Write-Host "✅ Target APIM deployed successfully: $(Protect-ApimName -Value $result.properties.outputs.apimServiceName.value)"
 
 return $result.properties.outputs

tests/integration/all-resource-types/DeploymentHelpers.psm1

@@ -0,0 +1,65 @@
+Import-Module (Join-Path $PSScriptRoot 'MaskingHelpers.psm1')
+
+function Write-DeploymentFailureDetails {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$ResourceGroupName,
+        [Parameter(Mandatory)][string]$DeploymentName,
+        [hashtable]$Replacements = @{}
+    )
+
+    $maskedRg = Protect-ResourceGroupName -Value $ResourceGroupName
+    Write-Host ""
+    Write-Host "========== Deployment failure details ==========" -ForegroundColor Yellow
+    Write-Host "Resource group: $maskedRg" -ForegroundColor Yellow
+    Write-Host "Deployment:     $DeploymentName" -ForegroundColor Yellow
+    Write-Host "Querying failed deployment operations (before teardown)..." -ForegroundColor Yellow
+
+    $query = "[?properties.provisioningState=='Failed'].{resource:properties.targetResource.resourceName, type:properties.targetResource.resourceType, code:properties.statusMessage.error.code, message:properties.statusMessage.error.message, details:properties.statusMessage.error.details}"
+
+    try {
+        Invoke-MaskedProcess -FilePath 'az' -Replacements $Replacements -Arguments @(
+            'deployment', 'operation', 'group', 'list',
+            '--resource-group', $ResourceGroupName,
+            '--name',           $DeploymentName,
+            '--query',          $query,
+            '--output',         'json'
+        )
+    } catch {
+        $maskedErr = Protect-LogLine -Line ($_.Exception.Message) -Replacements $Replacements
+        Write-Host "Failed to retrieve deployment operations: $maskedErr" -ForegroundColor Red
+    }
+
+    Write-Host "================================================" -ForegroundColor Yellow
+}
+
+function Wait-ApimActivation {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$ResourceGroupName,
+        [Parameter(Mandatory)][string]$ApimName,
+        [int]$TimeoutSeconds = 1800,
+        [int]$PollIntervalSeconds = 20
+    )
+
+    $maskedApim = Protect-ApimName -Value $ApimName
+    Write-Host "Waiting for APIM '$maskedApim' to finish Activating (timeout ${TimeoutSeconds}s)..." -ForegroundColor Cyan
+
+    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
+    $lastState = $null
+    while ((Get-Date) -lt $deadline) {
+        $state = az apim show --resource-group $ResourceGroupName --name $ApimName --query provisioningState --output tsv 2>$null
+        if ($state -ne $lastState) {
+            Write-Host "  provisioningState: $state" -ForegroundColor Gray
+            $lastState = $state
+        }
+        if ($state -eq 'Succeeded') { return $true }
+        if ($state -eq 'Failed') { throw "APIM '$maskedApim' entered Failed state during activation wait" }
+        Start-Sleep -Seconds $PollIntervalSeconds
+    }
+    throw "APIM '$maskedApim' did not reach Succeeded within ${TimeoutSeconds}s (last state: $lastState)"
+}
+
+Export-ModuleMember -Function `
+    Write-DeploymentFailureDetails, `
+    Wait-ApimActivation

tests/integration/all-resource-types/MaskingHelpers.psm1

@@ -1,69 +1,31 @@
-# MaskingHelpers — secret-redaction utilities for the round-trip integration
-# test scripts. Imported via:
-#
-#   Import-Module (Join-Path $PSScriptRoot 'MaskingHelpers.psm1') -Force
-#
-
-# Module-scoped flag. Flip to $false locally if you need to see raw values
-# while debugging — never commit that change.
+# MaskingHelpers — secret-redaction utilities for the round-trip integration test scripts.
+
 $script:EnableMasking = $true
 
-# Built-in regex redactions applied by Protect-LogLine on every line, in
-# addition to caller-supplied exact-match Replacements. These cover sensitive
-# values that the caller cannot enumerate up front (ARM async-operation
-# signing material, request IDs, etc.).
-#
-# IMPORTANT: keep these patterns conservative. We deliberately do NOT mask
-# every GUID, because well-known role-definition IDs and template hashes are
-# legitimately public and useful in debugging. Anchor patterns to the path
-# segment, header name, or query-parameter context that makes the value
-# sensitive.
-#
-# References:
-# - ARM async operations contract (see `Azure-AsyncOperation` /
-#   `operationStatuses` URL shape with t/c/s/h query parameters):
-#   https://learn.microsoft.com/azure/azure-resource-manager/management/async-operations
-# - Azure correlation / request IDs (`x-ms-correlation-request-id`,
-#   `x-ms-request-id`, `x-ms-client-request-id`):
-#   https://learn.microsoft.com/azure/azure-resource-manager/management/request-limits-and-throttling
 $script:BuiltinRedactions = @(
-    # ARM async-operation signing material: t= (timestamp), c= (cert),
-    # s= (signature), h= (hash) on operationStatuses / operationResults URLs.
-    # These query parameters are effectively a bearer credential for polling
-    # the long-running operation result and MUST NOT appear in logs.
     @{ Pattern = '([?&])(t|c|s|h)=[^&''"\s]+'
        Replacement = '$1$2=<REDACTED:arm-async>' }
 
-    # Azure subscription IDs embedded in ARM resource paths.
     @{ Pattern = '/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
-       Replacement = '/subscriptions/<SUBSCRIPTION_ID>' }
+       Replacement = '/subscriptions/<REDACTED:subscription-id>' }
 
-    # ARM long-running operation IDs (numeric or alphanumeric, 10+ chars)
-    # following /operationStatuses/ or /operationResults/.
     @{ Pattern = '/(operationStatuses|operationResults)/[A-Za-z0-9._-]{10,}'
-       Replacement = '/$1/<OPERATION_ID>' }
+       Replacement = '/$1/<REDACTED:operation-id>' }
 
-    # x-ms-correlation-request-id, x-ms-request-id, x-ms-client-request-id
-    # header values. Match Python-repr style (`'x-ms-request-id': 'guid'`),
-    # HTTP-header style (`x-ms-request-id: guid`), and JSON style.
     @{ Pattern = "(?i)(['""]?x-ms-(?:correlation-)?(?:request|client-request)-id['""]?\s*[:=]\s*['""]?)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
        Replacement = '$1<REDACTED:request-id>' }
 
-    # x-ms-routing-request-id: '<REGION>:<TIMESTAMP>:<guid>'. Mask the whole
-    # value because all three components (region, timestamp, GUID) leak
-    # tenant geography / activity timing.
     @{ Pattern = "(?i)(['""]?x-ms-routing-request-id['""]?\s*[:=]\s*['""]?)[A-Z0-9]+:\d{8}T\d{6}Z:[0-9a-fA-F-]{36}"
        Replacement = '$1<REDACTED:routing-request-id>' }
 
-    # Authorization: Bearer <token>  — defense in depth. We do not expect
-    # bearer tokens to appear because `az --debug` redacts them by default,
-    # but if Azure CLI ever changes that, this catches them.
     @{ Pattern = "(?i)(authorization[:\s=]+bearer\s+)[A-Za-z0-9._\-+/=]+"
        Replacement = '$1<REDACTED:bearer>' }
 
-    # JWT-shaped tokens (eyJ<base64url>.<base64url>.<base64url>).
     @{ Pattern = '\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}'
        Replacement = '<REDACTED:jwt>' }
+
+    @{ Pattern = '[A-Za-z0-9](?:[A-Za-z0-9._%+\-]*[A-Za-z0-9])?@[A-Za-z0-9](?:[A-Za-z0-9.\-]*[A-Za-z0-9])?\.[A-Za-z]{2,}'
+       Replacement = '<REDACTED:email>' }
 )
 
 function Protect-Identifier {
@@ -78,29 +40,32 @@ function Protect-Identifier {
     }
 
     if ([string]::IsNullOrWhiteSpace($Value)) {
-        return '<empty>'
+        return '<REDACTED:empty>'
     }
 
     if ($Value.Length -le ($Prefix + $Suffix)) {
-        return ('*' * $Value.Length)
+        return '<REDACTED>'
     }
 
     return "{0}...{1}" -f $Value.Substring(0, $Prefix), $Value.Substring($Value.Length - $Suffix)
 }
 
 function Protect-SubscriptionId {
     param([string]$Value)
-    return Protect-Identifier -Value $Value -Prefix 3 -Suffix 0
+    if (-not $script:EnableMasking) { return $Value }
+    return '<REDACTED:subscription-id>'
 }
 
-# Resource group names follow the convention `bvt-<timestamp>-<rand>-(src|tgt)-rg`.
-# Reveal the last 7 characters so the role suffix (`-src-rg` / `-tgt-rg`) is
-# visible in logs while the unique id stays masked.
 function Protect-ResourceGroupName {
     param([string]$Value)
     return Protect-Identifier -Value $Value -Prefix 3 -Suffix 7
 }
 
+function Protect-ApimName {
+    param([string]$Value)
+    return Protect-Identifier -Value $Value -Prefix 3 -Suffix 8
+}
+
 function Protect-LogLine {
     param(
         [string]$Line,
@@ -113,7 +78,6 @@ function Protect-LogLine {
 
     $protectedLine = $Line
 
-    # Pass 1: caller-supplied exact-string replacements (sub id, RG name, ...).
     if ($Replacements) {
         foreach ($entry in $Replacements.GetEnumerator()) {
             if ([string]::IsNullOrEmpty($entry.Key) -or [string]::IsNullOrEmpty($entry.Value)) {
@@ -124,9 +88,6 @@ function Protect-LogLine {
         }
     }
 
-    # Pass 2: built-in regex redactions for well-known secret shapes that
-    # callers cannot enumerate up front (ARM signing material, request IDs,
-    # operation IDs, bearer tokens). Always applied.
     foreach ($rule in $script:BuiltinRedactions) {
         $protectedLine = [System.Text.RegularExpressions.Regex]::Replace(
             $protectedLine,
@@ -137,11 +98,6 @@ function Protect-LogLine {
     return $protectedLine
 }
 
-# Native-process invocation with masked output. Uses System.Diagnostics.Process
-# with redirected stdout/stderr so the child's raw bytes bypass PowerShell's
-# ErrorRecord promotion (which would otherwise leak unmasked to Start-Transcript).
-
-# Windows npm shims (e.g. npx.cmd) need cmd.exe; *nix shebang scripts launch directly.
 function Resolve-NativeExecutable {
     param([string]$Name)
 
@@ -159,8 +115,6 @@ function Resolve-NativeExecutable {
     return [pscustomobject]@{ FilePath = $exePath; Prefix = $prefix }
 }
 
-# Stderr is always masked + streamed. Stdout is either captured (and returned)
-# or masked + streamed. Sets $global:LASTEXITCODE.
 function Invoke-MaskedProcess {
     [CmdletBinding()]
     param(
@@ -180,7 +134,6 @@ function Invoke-MaskedProcess {
     $psi.RedirectStandardInput  = $false
     $psi.UseShellExecute        = $false
     $psi.CreateNoWindow         = $true
-    # Default OEM encoding on Windows mangles `az --debug` output.
     $psi.StandardOutputEncoding = [System.Text.Encoding]::UTF8
     $psi.StandardErrorEncoding  = [System.Text.Encoding]::UTF8
 
@@ -194,15 +147,11 @@ function Invoke-MaskedProcess {
     $proc = [System.Diagnostics.Process]::new()
     $proc.StartInfo = $psi
 
-    # Allocate explicitly — `$x = if (...) { [List[T]]::new() }` returns $null
-    # because PowerShell enumerates the empty list.
     $stdoutBuffer = $null
     if ($CaptureStdout) {
         $stdoutBuffer = [System.Collections.Generic.List[string]]::new()
     }
 
-    # Use ThreadJob readers rather than Register-ObjectEvent: Action handlers
-    # don't drain reliably while the main runspace is in Start-Sleep.
     $readerScript = {
         param([System.IO.StreamReader]$Reader,
               [System.Collections.Concurrent.ConcurrentQueue[string]]$Queue)
@@ -241,7 +190,6 @@ function Invoke-MaskedProcess {
             }
         }
 
-        # Readers exit on EOF once the child closes its pipes.
         Wait-Job -Job $outJob, $errJob | Out-Null
 
         while ($stderrQueue.TryDequeue([ref]$line)) {
@@ -268,7 +216,6 @@ function Invoke-MaskedProcess {
     }
 }
 
-# Run `npx apiops <args>` masking ALL output streams. Returns the exit code.
 function Invoke-MaskedApiopsCommand {
     [CmdletBinding()]
     param(
@@ -283,9 +230,6 @@ function Invoke-MaskedApiopsCommand {
     return $LASTEXITCODE
 }
 
-# Run `az <args>` capturing stdout (typically JSON) for the caller while
-# masking and streaming stderr (verbose/debug output). Returns stdout as a
-# single string. Sets/preserves $LASTEXITCODE for the caller.
 function Invoke-MaskedAzCommand {
     [CmdletBinding()]
     param(
@@ -303,6 +247,7 @@ Export-ModuleMember -Function `
     Protect-Identifier, `
     Protect-SubscriptionId, `
     Protect-ResourceGroupName, `
+    Protect-ApimName, `
     Protect-LogLine, `
     Resolve-NativeExecutable, `
     Invoke-MaskedProcess, `