Check Versions of Bicep files API versions

[JonasCordsen]

Would it be an idea to add the function for PS rule to check the version that bicep is trying to use, just like it does on azure.template schema?

Like the functionality that it present in armttk where schema should be newest or within two years?

[BernieWhite]

@JonasCordsen Thanks for the idea on a new feature.

Our understanding is that the Bicep linter will support this over the next few dot releases.

But if the community would like the functionality within the PSRule for Azure then we'd be happy to look at implementing it. We already collect some of the information so it may not be too hard to implement.

---

If you want to support this idea, please ⬆️ vote.

[BernieWhite]

@ReneRebsdorf Thanks for the question. We are absolutely discussing this internally and hope to have a clearer message in the future for customers.

[BernieWhite]

@ReneRebsdorf You may have seen the Ignite 2022 announcements.

Currently ARM-TTK is available however, it is not moving forward to support Bicep. The rules that exist in ARM-TTK have been implemented in the Bicep linter or PSRule for Azure or both where it made sense.

Going forward for DevSecOps, consider Microsoft Defender for DevOps (public preview) which we see as a comprehensive security solution and it will continue to evolve as we move towards GA and beyond.

Microsoft Defender for DevOps includes a number of security tools for scanning different types of IaC. For ARM templates and Bicep code this is Template-analyzer (BPA). Under the covers BPA uses PSRule for Azure as well as some other scanning logic. These tools are mostly focussed on the Security pillar, although we'll continue to work through how we intend to expose other pillars.

So essentially you have two ways to consume PSRule for Azure either via Microsoft Defender for DevOps or through the tooling we currently and plan to continue improve and support for the foreseeable future (we've still got so many features we'd like to deliver). If consuming via Microsoft Defender for DevOps you also get the benefits listed here too https://www.microsoft.com/en-us/security/business/cloud-security/microsoft-defender-devops so we hope you try this option for your DevSecOps workflows.

[ReneRebsdorf]

@BernieWhite Thank you for getting back 🙂

We were in the know on Defender for DevOps, and we're happy to hear of its release to public preview.
Unfortunately it is regionally limited at this time, prohibiting us for use at several clients.

We will instead look into migrating to Ps Rule for Azure, and away from arm-ttk.

You mentioned 'where it made sense', do you have examples of what was not included, or any writing on this 'gap'?

[BernieWhite]

Good question, we should probably document this separately. We focussed on tests that had an impact on security however PSRule for Azure already included a number of rules that overlapped with TTK rules that were non security released.

Also we didn't include any tests for CreateUiDefinition files.

[ReneRebsdorf]

Thank you for clarifying. @BernieWhite 🙂

[BernieWhite]

Some additional thoughts on this proposal:

• The rule should be opt-in, enabled by configuration for environments what want to use it. Such as AZURE_RESOURCE_APIVERSION_MAXAGE = 730 for two years.
• Should not force rolling forward to an API version with -preview in it's name.