Repository: cloud-custodian/cloud-custodian

Issue:
azure - ensure Event Grid mode works properly with child resources
We have ARM and not ARM child resources. 

It looks like non-arm child resources now won't work with event triggered mode at all.

ARM resources work differently as if we run it in Pull mode (different API is used, no `c7n:parent-id` property)


Discussion:
As an update - non-ARM resources are not supported in Event Grid, per: https://docs.microsoft.com/en-us/azure/event-grid/overview

Will add validation logic to prevent users from adding them as the `resource` in event grid mode. 

Resolving patch:
diff --git a/tools/c7n_azure/c7n_azure/azure_events.py b/tools/c7n_azure/c7n_azure/azure_events.py
--- a/tools/c7n_azure/c7n_azure/azure_events.py
+++ b/tools/c7n_azure/c7n_azure/azure_events.py
@@ -24,13 +24,6 @@ class AzureEvents(object):
     """A mapping of resource types to events."""
 
     azure_events = {
-        'RoleAssignmentWrite': {
-            'resource_provider': 'Microsoft.Authorization/roleAssignments',
-            'event': 'write'},
-
-        'RoleDefinitionW': {
-            'resource_provider': 'Microsoft.Authorization/roleDefinitions',
-            'event': 'write'},
 
         'AppServicePlanWrite': {
             'resource_provider': 'Microsoft.Web/serverFarms',
diff --git a/tools/c7n_azure/c7n_azure/policy.py b/tools/c7n_azure/c7n_azure/policy.py
--- a/tools/c7n_azure/c7n_azure/policy.py
+++ b/tools/c7n_azure/c7n_azure/policy.py
@@ -25,6 +25,8 @@
                                  RESOURCE_GROUPS_TYPE)
 from c7n_azure.function_package import FunctionPackage
 from c7n_azure.functionapp_utils import FunctionAppUtilities
+from c7n_azure.resources.arm import ArmResourceManager
+from c7n_azure.resources.generic_arm_resource import GenericArmResource
 from c7n_azure.storage_utils import StorageUtilities
 from c7n_azure.utils import ResourceIdParser, StringUtils
 
@@ -359,12 +361,23 @@ def __init__(self, policy):
 
     def validate(self):
         super(AzureEventGridMode, self).validate()
+        self._validate_is_arm_resource()
+        self._validate_event_matches_resource()
+
+    def _validate_is_arm_resource(self):
+        if not isinstance(self.policy.resource_manager, ArmResourceManager):
+            raise PolicyValidationError(
+                'The policy resource, {}, is not supported in event grid mode.'.format(
+                    self.policy.data['resource']))
+
+    def _validate_event_matches_resource(self):
         resource_type = self.policy.resource_manager.resource_type.resource_type
-        for event in self.subscribed_events:
-            if resource_type.lower() not in event.lower():
-                raise PolicyValidationError(
-                    'The policy resource, {}, can not be triggered by the event, {}.'.format(
-                        resource_type, event))
+        if resource_type is not GenericArmResource.resource_type.resource_type:
+            for event in self.subscribed_events:
+                if resource_type.lower() not in event.lower():
+                    raise PolicyValidationError(
+                        'The policy resource, {}, can not be triggered by the event, {}.'.format(
+                            resource_type, event))
 
     def provision(self):
         super(AzureEventGridMode, self).provision()


Test patch:
diff --git a/tools/c7n_azure/tests_azure/test_policy_mode.py b/tools/c7n_azure/tests_azure/test_policy_mode.py
--- a/tools/c7n_azure/tests_azure/test_policy_mode.py
+++ b/tools/c7n_azure/tests_azure/test_policy_mode.py
@@ -117,6 +117,36 @@ def test_azure_function_event_mode_child_event_type(self):
             }, validate=True)
             self.assertTrue(p)
 
+    def test_azure_function_event_mode_generic_resource_type(self):
+        with self.sign_out_patch():
+            p = self.load_policy({
+                'name': 'test-azure-serverless-mode',
+                'resource': 'azure.armresource',
+                'mode': {
+                    'type': FUNCTION_EVENT_TRIGGER_MODE,
+                    'events': [
+                            'KeyVaultWrite',
+                            'ResourceGroupWrite',
+                            'VmWrite'
+                    ]
+                }
+            }, validate=True)
+            self.assertTrue(p)
+
+    def test_azure_function_event_mode_unsupported_resource_type(self):
+        with self.sign_out_patch():
+            with self.assertRaises(PolicyValidationError):
+                self.load_policy({
+                    'name': 'test-azure-serverless-mode',
+                    'resource': 'azure.keyvault-key',
+                    'mode': {
+                        'type': FUNCTION_EVENT_TRIGGER_MODE,
+                        'events': [
+                            'KeyVaultWrite',
+                        ]
+                    }
+                }, validate=True)
+
     def test_azure_function_periodic_mode_schema_validation(self):
         with self.sign_out_patch():
             p = self.load_policy({