From 137ed76d826303fee9eb13cae67cf5bc72ac3a63 Mon Sep 17 00:00:00 2001
From: Anthony Shaw <anthony.p.shaw@gmail.com>
Date: Thu, 6 Jun 2024 14:04:15 +1000
Subject: [PATCH 1/2] Use PSRule for security testing

---
 .github/workflows/bicep-audit.yml | 22 +++++++++++++++-------
 infra/main.test.bicep             | 17 +++++++++++++++++
 ps-rule.yaml                      |  3 +++
 3 files changed, 35 insertions(+), 7 deletions(-)
 create mode 100644 infra/main.test.bicep
 create mode 100644 ps-rule.yaml

diff --git a/.github/workflows/bicep-audit.yml b/.github/workflows/bicep-audit.yml
index eb7f66d..6eae131 100644
--- a/.github/workflows/bicep-audit.yml
+++ b/.github/workflows/bicep-audit.yml
@@ -21,15 +21,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Run Microsoft Security DevOps Analysis
-        uses: microsoft/security-devops-action@preview
-        id: msdo
-        continue-on-error: true
+      - name: Run PSRule analysis
+        uses: microsoft/ps-rule@v2.9.0
         with:
-          tools: templateanalyzer
+          modules: PSRule.Rules.Azure
+          baseline: Azure.Pillar.Security
+          inputPath: infra/*.test.bicep
+          outputFormat: Sarif
+          outputPath: reports/ps-rule-results.sarif
+          summary: true
+        continue-on-error: true
+          
+        env:
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION: 'true'
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION_TIMEOUT: '30'
 
-      - name: Upload alerts to Security tab
+      - name: Upload results to security tab
         uses: github/codeql-action/upload-sarif@v3
         if: github.repository_owner == 'Azure-Samples'
         with:
-          sarif_file: ${{ steps.msdo.outputs.sarifFile }}
+          sarif_file: reports/ps-rule-results.sarif
diff --git a/infra/main.test.bicep b/infra/main.test.bicep
new file mode 100644
index 0000000..1933cdf
--- /dev/null
+++ b/infra/main.test.bicep
@@ -0,0 +1,17 @@
+// This file is for doing static analysis and contains sensible defaults
+// for the bicep analyser to minimise false-positives and provide the best results.
+
+// This file is not intended to be used as a runtime configuration file.
+
+targetScope = 'subscription'
+
+param environmentName string = 'testing'
+param location string = 'westus2'
+
+module main 'main.bicep' = {
+  name: 'main'
+  params: {
+    name: environmentName
+    location: location
+  }
+}
diff --git a/ps-rule.yaml b/ps-rule.yaml
new file mode 100644
index 0000000..bb4904b
--- /dev/null
+++ b/ps-rule.yaml
@@ -0,0 +1,3 @@
+# YAML: Set the AZURE_BICEP_FILE_EXPANSION configuration option to enable expansion
+configuration:
+  AZURE_BICEP_FILE_EXPANSION: true
\ No newline at end of file

From 94914a2b69cc94af9a9fa81c3b27e9a089384ec9 Mon Sep 17 00:00:00 2001
From: Anthony Shaw <anthony.p.shaw@gmail.com>
Date: Thu, 6 Jun 2024 14:14:32 +1000
Subject: [PATCH 2/2] Disable AOAI public rules

---
 ps-rule.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ps-rule.yaml b/ps-rule.yaml
index bb4904b..ab2b170 100644
--- a/ps-rule.yaml
+++ b/ps-rule.yaml
@@ -1,3 +1,11 @@
 # YAML: Set the AZURE_BICEP_FILE_EXPANSION configuration option to enable expansion
 configuration:
-  AZURE_BICEP_FILE_EXPANSION: true
\ No newline at end of file
+  AZURE_BICEP_FILE_EXPANSION: true
+
+rule:
+  exclude:
+  # This template is for load-balancing a public-facing Azure OpenAI instance
+  # so these rules aren't applicable.
+   - Azure.AI.PublicAccess
+   - Azure.AI.DisableLocalAuth
+   - Azure.AI.PrivateEndpoints
\ No newline at end of file