Repository: cloud-custodian/cloud-custodian

Issue:
azure - firewall to support 'any', 'only' options
Azure Firewall filter should support scenario when user specifies a list of allowed IPs and wants to ensure resources don't allow access from any IP outside of the list.


Discussion:

Resolving patch:
diff --git a/tools/c7n_azure/c7n_azure/filters.py b/tools/c7n_azure/c7n_azure/filters.py
--- a/tools/c7n_azure/c7n_azure/filters.py
+++ b/tools/c7n_azure/c7n_azure/filters.py
@@ -17,6 +17,7 @@
 from datetime import timedelta
 
 import six
+from netaddr import AddrFormatError
 from azure.mgmt.costmanagement.models import QueryDefinition, QueryDataset, \
     QueryAggregation, QueryGrouping, QueryTimePeriod, TimeframeType, QueryFilter, \
     QueryComparisonExpression
@@ -484,6 +485,17 @@ def get_tag_value(self, i):
 class FirewallRulesFilter(Filter):
     """Filters resources by the firewall rules
 
+    Rules can be specified as x.x.x.x-y.y.y.y or x.x.x.x or x.x.x.x/y.
+
+    With the exception of **equal** all modes reference total IP space and ignore
+    specific notation.
+
+    **include**: True if all IP space listed is included in firewall.
+    **any**: True if any overlap in IP space exists.
+    **only**: True if firewall IP space only includes IPs from provided space
+    (firewall is subset of provided space).
+    **equal**: the list of IP ranges or CIDR that firewall rules must match exactly.
+
     :example:
 
     .. code-block:: yaml
@@ -498,18 +510,32 @@ class FirewallRulesFilter(Filter):
                             - 10.20.20.0/24
     """
 
-    schema = type_schema(
-        'firewall-rules',
-        **{
+    schema = {
+        'type': 'object',
+        'additionalProperties': False,
+        'properties': {
+            'type': {'enum': ['firewall-rules']},
             'include': {'type': 'array', 'items': {'type': 'string'}},
+            'any': {'type': 'array', 'items': {'type': 'string'}},
+            'only': {'type': 'array', 'items': {'type': 'string'}},
             'equal': {'type': 'array', 'items': {'type': 'string'}}
-        })
+        },
+        'oneOf': [
+            {"required": ["type", "include"]},
+            {"required": ["type", "any"]},
+            {"required": ["type", "only"]},
+            {"required": ["type", "equal"]}
+        ]
+    }
+
     schema_alias = True
 
     def __init__(self, data, manager=None):
         super(FirewallRulesFilter, self).__init__(data, manager)
         self.policy_include = None
         self.policy_equal = None
+        self.policy_any = None
+        self.policy_only = None
 
     @property
     @abstractmethod
@@ -517,21 +543,21 @@ def log(self):
         raise NotImplementedError()
 
     def validate(self):
+        try:
+            IpRangeHelper.parse_ip_ranges(self.data, 'include')
+            IpRangeHelper.parse_ip_ranges(self.data, 'equal')
+            IpRangeHelper.parse_ip_ranges(self.data, 'any')
+            IpRangeHelper.parse_ip_ranges(self.data, 'only')
+        except AddrFormatError as e:
+            raise PolicyValidationError("Invalid IP range found. %s" % e)
+        return self
+
+    def process(self, resources, event=None):
         self.policy_include = IpRangeHelper.parse_ip_ranges(self.data, 'include')
         self.policy_equal = IpRangeHelper.parse_ip_ranges(self.data, 'equal')
+        self.policy_any = IpRangeHelper.parse_ip_ranges(self.data, 'any')
+        self.policy_only = IpRangeHelper.parse_ip_ranges(self.data, 'only')
 
-        has_include = self.policy_include is not None
-        has_equal = self.policy_equal is not None
-
-        if has_include and has_equal:
-            raise FilterValidationError('Cannot have both include and equal.')
-
-        if not has_include and not has_equal:
-            raise FilterValidationError('Must have either include or equal.')
-
-        return True
-
-    def process(self, resources, event=None):
         result, _ = ThreadHelper.execute_in_parallel(
             resources=resources,
             event=event,
@@ -562,8 +588,15 @@ def _check_resource(self, resource):
     def _check_rules(self, resource_rules):
         if self.policy_equal is not None:
             return self.policy_equal == resource_rules
+
         elif self.policy_include is not None:
             return self.policy_include.issubset(resource_rules)
+
+        elif self.policy_any is not None:
+            return not self.policy_any.isdisjoint(resource_rules)
+
+        elif self.policy_only is not None:
+            return resource_rules.issubset(self.policy_only)
         else:  # validated earlier, can never happen
             raise FilterValidationError("Internal error.")
 


Test patch:
diff --git a/tools/c7n_azure/tests/azure_common.py b/tools/c7n_azure/tests/azure_common.py
--- a/tools/c7n_azure/tests/azure_common.py
+++ b/tools/c7n_azure/tests/azure_common.py
@@ -16,6 +16,7 @@
 import json
 import os
 import re
+from functools import wraps
 
 import msrest.polling
 from azure_serializer import AzureSerializer
@@ -121,6 +122,13 @@ def is_playback(self):
         # has completed initializing the cassette instance.
         return not hasattr(self, 'cassette') or os.path.isfile(self.cassette._path)
 
+    def _get_cassette_name(self):
+        test_method = getattr(self, self._testMethodName)
+        name_override = getattr(test_method, 'cassette_name', None)
+        method_name = name_override or self._testMethodName
+        return '{0}.{1}.yaml'.format(self.__class__.__name__,
+                                     method_name)
+
     def _get_vcr_kwargs(self):
         return super(VCRTestCase, self)._get_vcr_kwargs(
             before_record_request=self._request_callback,
@@ -397,6 +405,7 @@ def session_client_wrapper(self, client):
 
 def arm_template(template):
     def decorator(func):
+        @wraps(func)
         def wrapper(*args, **kwargs):
             template_file_path = os.path.dirname(__file__) + "/templates/" + template
             if not os.path.isfile(template_file_path):
@@ -406,6 +415,13 @@ def wrapper(*args, **kwargs):
     return decorator
 
 
+def cassette_name(name):
+    def decorator(func):
+        func.cassette_name = name
+        return func
+    return decorator
+
+
 def requires_arm_polling(cls):
     orig_init = cls.__init__
     # Make copy of original __init__, so we can call it without recursion
diff --git a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_include_all_ranges.json b/tools/c7n_azure/tests/cassettes/CosmosDBTest.firewall.json
similarity index 100%
rename from tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_include_all_ranges.json
rename to tools/c7n_azure/tests/cassettes/CosmosDBTest.firewall.json
diff --git a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include.json b/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include.json
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.DocumentDB/databaseAccounts?api-version=2015-04-08",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "Ok"
-                },
-                "headers": {
-                    "x-ms-gatewayversion": [
-                        "version=2.4.0.0"
-                    ],
-                    "date": [
-                        "Mon, 01 Jul 2019 19:58:00 GMT"
-                    ],
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "1717"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_cosmosdb/providers/Microsoft.DocumentDB/databaseAccounts/cctestcosmosdb",
-                                "name": "cctestcosmosdb",
-                                "location": "South Central US",
-                                "type": "Microsoft.DocumentDB/databaseAccounts",
-                                "kind": "GlobalDocumentDB",
-                                "tags": {},
-                                "properties": {
-                                    "provisioningState": "Succeeded",
-                                    "documentEndpoint": "https://cctestcosmosdb.documents.azure.com:443/",
-                                    "ipRangeFilter": "0.0.0.0/1,128.0.0.0/1",
-                                    "enableAutomaticFailover": false,
-                                    "enableMultipleWriteLocations": false,
-                                    "enablePartitionKeyMonitor": false,
-                                    "isVirtualNetworkFilterEnabled": false,
-                                    "virtualNetworkRules": [],
-                                    "EnabledApiTypes": "Sql",
-                                    "databaseAccountOfferType": "Standard",
-                                    "consistencyPolicy": {
-                                        "defaultConsistencyLevel": "Session",
-                                        "maxIntervalInSeconds": 5,
-                                        "maxStalenessPrefix": 100
-                                    },
-                                    "configurationOverrides": {},
-                                    "writeLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "readLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "locations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "failoverPolicies": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "failoverPriority": 0
-                                        }
-                                    ],
-                                    "cors": [],
-                                    "capabilities": []
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include_cidr.json b/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include_cidr.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_include_cidr.json
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.DocumentDB/databaseAccounts?api-version=2015-04-08",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "Ok"
-                },
-                "headers": {
-                    "x-ms-gatewayversion": [
-                        "version=2.4.0.0"
-                    ],
-                    "date": [
-                        "Mon, 01 Jul 2019 19:58:00 GMT"
-                    ],
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "1717"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_cosmosdb/providers/Microsoft.DocumentDB/databaseAccounts/cctestcosmosdb",
-                                "name": "cctestcosmosdb",
-                                "location": "South Central US",
-                                "type": "Microsoft.DocumentDB/databaseAccounts",
-                                "kind": "GlobalDocumentDB",
-                                "tags": {},
-                                "properties": {
-                                    "provisioningState": "Succeeded",
-                                    "documentEndpoint": "https://cctestcosmosdb.documents.azure.com:443/",
-                                    "ipRangeFilter": "0.0.0.0/1,128.0.0.0/1",
-                                    "enableAutomaticFailover": false,
-                                    "enableMultipleWriteLocations": false,
-                                    "enablePartitionKeyMonitor": false,
-                                    "isVirtualNetworkFilterEnabled": false,
-                                    "virtualNetworkRules": [],
-                                    "EnabledApiTypes": "Sql",
-                                    "databaseAccountOfferType": "Standard",
-                                    "consistencyPolicy": {
-                                        "defaultConsistencyLevel": "Session",
-                                        "maxIntervalInSeconds": 5,
-                                        "maxStalenessPrefix": 100
-                                    },
-                                    "configurationOverrides": {},
-                                    "writeLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "readLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "locations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "failoverPolicies": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "failoverPriority": 0
-                                        }
-                                    ],
-                                    "cors": [],
-                                    "capabilities": []
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_equal.json b/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_equal.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_equal.json
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.DocumentDB/databaseAccounts?api-version=2015-04-08",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "Ok"
-                },
-                "headers": {
-                    "x-ms-gatewayversion": [
-                        "version=2.4.0.0"
-                    ],
-                    "date": [
-                        "Mon, 01 Jul 2019 19:58:01 GMT"
-                    ],
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "1717"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_cosmosdb/providers/Microsoft.DocumentDB/databaseAccounts/cctestcosmosdb",
-                                "name": "cctestcosmosdb",
-                                "location": "South Central US",
-                                "type": "Microsoft.DocumentDB/databaseAccounts",
-                                "kind": "GlobalDocumentDB",
-                                "tags": {},
-                                "properties": {
-                                    "provisioningState": "Succeeded",
-                                    "documentEndpoint": "https://cctestcosmosdb.documents.azure.com:443/",
-                                    "ipRangeFilter": "0.0.0.0/1,128.0.0.0/1",
-                                    "enableAutomaticFailover": false,
-                                    "enableMultipleWriteLocations": false,
-                                    "enablePartitionKeyMonitor": false,
-                                    "isVirtualNetworkFilterEnabled": false,
-                                    "virtualNetworkRules": [],
-                                    "EnabledApiTypes": "Sql",
-                                    "databaseAccountOfferType": "Standard",
-                                    "consistencyPolicy": {
-                                        "defaultConsistencyLevel": "Session",
-                                        "maxIntervalInSeconds": 5,
-                                        "maxStalenessPrefix": 100
-                                    },
-                                    "configurationOverrides": {},
-                                    "writeLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "readLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "locations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "failoverPolicies": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "failoverPriority": 0
-                                        }
-                                    ],
-                                    "cors": [],
-                                    "capabilities": []
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_include_cidr.json b/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_include_cidr.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/CosmosDBTest.test_firewall_rules_not_include_cidr.json
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.DocumentDB/databaseAccounts?api-version=2015-04-08",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "Ok"
-                },
-                "headers": {
-                    "x-ms-gatewayversion": [
-                        "version=2.4.0.0"
-                    ],
-                    "date": [
-                        "Mon, 01 Jul 2019 19:58:03 GMT"
-                    ],
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "1717"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_cosmosdb/providers/Microsoft.DocumentDB/databaseAccounts/cctestcosmosdb",
-                                "name": "cctestcosmosdb",
-                                "location": "South Central US",
-                                "type": "Microsoft.DocumentDB/databaseAccounts",
-                                "kind": "GlobalDocumentDB",
-                                "tags": {},
-                                "properties": {
-                                    "provisioningState": "Succeeded",
-                                    "documentEndpoint": "https://cctestcosmosdb.documents.azure.com:443/",
-                                    "ipRangeFilter": "0.0.0.0/1,128.0.0.0/1",
-                                    "enableAutomaticFailover": false,
-                                    "enableMultipleWriteLocations": false,
-                                    "enablePartitionKeyMonitor": false,
-                                    "isVirtualNetworkFilterEnabled": false,
-                                    "virtualNetworkRules": [],
-                                    "EnabledApiTypes": "Sql",
-                                    "databaseAccountOfferType": "Standard",
-                                    "consistencyPolicy": {
-                                        "defaultConsistencyLevel": "Session",
-                                        "maxIntervalInSeconds": 5,
-                                        "maxStalenessPrefix": 100
-                                    },
-                                    "configurationOverrides": {},
-                                    "writeLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "readLocations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "locations": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "documentEndpoint": "https://cctestcosmosdb-southcentralus.documents.azure.com:443/",
-                                            "provisioningState": "Succeeded",
-                                            "failoverPriority": 0,
-                                            "isZoneRedundant": false
-                                        }
-                                    ],
-                                    "failoverPolicies": [
-                                        {
-                                            "id": "cctestcosmosdb-southcentralus",
-                                            "locationName": "South Central US",
-                                            "failoverPriority": 0
-                                        }
-                                    ],
-                                    "cors": [],
-                                    "capabilities": []
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_include_cidr.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.firewall.json
similarity index 100%
rename from tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_include_cidr.json
rename to tools/c7n_azure/tests/cassettes/SqlServerTest.firewall.json
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_equal.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_equal.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_equal.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Sql/servers?api-version=2015-05-01-preview",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154707Z:09a04d8d-97c1-4559-b0dc-cfa02c6a3fac"
-                    ],
-                    "Expires": [
-                        "-1"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:06 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "df366c87-d60d-4b8b-81bf-f674b264458a"
-                    ],
-                    "Pragma": [
-                        "no-cache"
-                    ],
-                    "Content-Type": [
-                        "application/json; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "09a04d8d-97c1-4559-b0dc-cfa02c6a3fac"
-                    ],
-                    "Cache-Control": [
-                        "no-cache"
-                    ],
-                    "content-length": [
-                        "428"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"kind\":\"v12.0\",\"properties\":{\"administratorLogin\":\"custodian\",\"version\":\"12.0\",\"state\":\"Ready\",\"fullyQualifiedDomainName\":\"cctestsqlserverj6y6cbbtaphs4.database.windows.net\"},\"location\":\"eastus2\",\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4\",\"name\":\"cctestsqlserverj6y6cbbtaphs4\",\"type\":\"Microsoft.Sql/servers\"}]}"
-                }
-            }
-        },
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules?api-version=2014-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154708Z:52298546-5df7-44e0-85a2-879679926a7b"
-                    ],
-                    "DataServiceVersion": [
-                        "3.0;"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:07 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "1f618368-f615-4b20-aa0c-0987e6c6f335"
-                    ],
-                    "Content-Type": [
-                        "application/json; odata=minimalmetadata; streaming=true; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "52298546-5df7-44e0-85a2-879679926a7b"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Cache-Control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "739"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/1.2.2.128s25\",\"name\":\"1.2.2.128s25\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"1.2.2.128\",\"endIpAddress\":\"1.2.2.255\"}},{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/AllowAllWindowsAzureIps\",\"name\":\"AllowAllWindowsAzureIps\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"0.0.0.0\",\"endIpAddress\":\"0.0.0.0\"}}]}"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_cidr.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_cidr.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_cidr.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Sql/servers?api-version=2015-05-01-preview",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154708Z:180eba2b-eb1f-40e4-b3bc-4ed1c5488b40"
-                    ],
-                    "Expires": [
-                        "-1"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:07 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "abe07482-bd9a-45cd-8975-feb837ad916e"
-                    ],
-                    "Pragma": [
-                        "no-cache"
-                    ],
-                    "Content-Type": [
-                        "application/json; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "180eba2b-eb1f-40e4-b3bc-4ed1c5488b40"
-                    ],
-                    "Cache-Control": [
-                        "no-cache"
-                    ],
-                    "content-length": [
-                        "428"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"kind\":\"v12.0\",\"properties\":{\"administratorLogin\":\"custodian\",\"version\":\"12.0\",\"state\":\"Ready\",\"fullyQualifiedDomainName\":\"cctestsqlserverj6y6cbbtaphs4.database.windows.net\"},\"location\":\"eastus2\",\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4\",\"name\":\"cctestsqlserverj6y6cbbtaphs4\",\"type\":\"Microsoft.Sql/servers\"}]}"
-                }
-            }
-        },
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules?api-version=2014-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154705Z:56501907-e343-40b8-ba81-998b23e5f61f"
-                    ],
-                    "DataServiceVersion": [
-                        "3.0;"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:04 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "fed1029b-0093-4556-88c7-714b3babeb67"
-                    ],
-                    "Content-Type": [
-                        "application/json; odata=minimalmetadata; streaming=true; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "56501907-e343-40b8-ba81-998b23e5f61f"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Cache-Control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "739"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/1.2.2.128s25\",\"name\":\"1.2.2.128s25\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"1.2.2.128\",\"endIpAddress\":\"1.2.2.255\"}},{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/AllowAllWindowsAzureIps\",\"name\":\"AllowAllWindowsAzureIps\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"0.0.0.0\",\"endIpAddress\":\"0.0.0.0\"}}]}"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_range.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_range.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_include_range.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Sql/servers?api-version=2015-05-01-preview",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154710Z:b4ca6268-a691-4909-ac93-30898e7d9098"
-                    ],
-                    "Expires": [
-                        "-1"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:09 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "46ce3eef-fe0a-4fb6-ac1d-b61eb71982e2"
-                    ],
-                    "Pragma": [
-                        "no-cache"
-                    ],
-                    "Content-Type": [
-                        "application/json; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "b4ca6268-a691-4909-ac93-30898e7d9098"
-                    ],
-                    "Cache-Control": [
-                        "no-cache"
-                    ],
-                    "content-length": [
-                        "428"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"kind\":\"v12.0\",\"properties\":{\"administratorLogin\":\"custodian\",\"version\":\"12.0\",\"state\":\"Ready\",\"fullyQualifiedDomainName\":\"cctestsqlserverj6y6cbbtaphs4.database.windows.net\"},\"location\":\"eastus2\",\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4\",\"name\":\"cctestsqlserverj6y6cbbtaphs4\",\"type\":\"Microsoft.Sql/servers\"}]}"
-                }
-            }
-        },
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules?api-version=2014-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154711Z:e256965f-02bb-485e-bd2b-fb5667fe4e1f"
-                    ],
-                    "DataServiceVersion": [
-                        "3.0;"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:11 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "3ab55fc5-48ce-4bd7-aca0-76039cd7e44e"
-                    ],
-                    "Content-Type": [
-                        "application/json; odata=minimalmetadata; streaming=true; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "e256965f-02bb-485e-bd2b-fb5667fe4e1f"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Cache-Control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "739"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/1.2.2.128s25\",\"name\":\"1.2.2.128s25\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"1.2.2.128\",\"endIpAddress\":\"1.2.2.255\"}},{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/AllowAllWindowsAzureIps\",\"name\":\"AllowAllWindowsAzureIps\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"0.0.0.0\",\"endIpAddress\":\"0.0.0.0\"}}]}"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_equal.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_equal.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_equal.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Sql/servers?api-version=2015-05-01-preview",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154712Z:89016639-c92b-4575-ae0e-56b541026179"
-                    ],
-                    "Expires": [
-                        "-1"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:12 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "5fda5ae0-58fb-4526-a1dc-ad9ff25c2c68"
-                    ],
-                    "Pragma": [
-                        "no-cache"
-                    ],
-                    "Content-Type": [
-                        "application/json; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "89016639-c92b-4575-ae0e-56b541026179"
-                    ],
-                    "Cache-Control": [
-                        "no-cache"
-                    ],
-                    "content-length": [
-                        "428"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"kind\":\"v12.0\",\"properties\":{\"administratorLogin\":\"custodian\",\"version\":\"12.0\",\"state\":\"Ready\",\"fullyQualifiedDomainName\":\"cctestsqlserverj6y6cbbtaphs4.database.windows.net\"},\"location\":\"eastus2\",\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4\",\"name\":\"cctestsqlserverj6y6cbbtaphs4\",\"type\":\"Microsoft.Sql/servers\"}]}"
-                }
-            }
-        },
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules?api-version=2014-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154713Z:612731ae-0993-43cc-85a7-3ce297aa4951"
-                    ],
-                    "DataServiceVersion": [
-                        "3.0;"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:12 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "3c0a9f2d-87d1-4f8d-a4e8-c55c9bc54d02"
-                    ],
-                    "Content-Type": [
-                        "application/json; odata=minimalmetadata; streaming=true; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "612731ae-0993-43cc-85a7-3ce297aa4951"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Cache-Control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "739"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/1.2.2.128s25\",\"name\":\"1.2.2.128s25\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"1.2.2.128\",\"endIpAddress\":\"1.2.2.255\"}},{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/AllowAllWindowsAzureIps\",\"name\":\"AllowAllWindowsAzureIps\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"0.0.0.0\",\"endIpAddress\":\"0.0.0.0\"}}]}"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_include_all_ranges.json b/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_include_all_ranges.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/SqlServerTest.test_firewall_rules_not_include_all_ranges.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Sql/servers?api-version=2015-05-01-preview",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154718Z:a9401aa1-2d1b-4215-88e6-b36a12a8f448"
-                    ],
-                    "Expires": [
-                        "-1"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:17 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "220ccb21-71d6-4c89-b55e-2a77838dfebc"
-                    ],
-                    "Pragma": [
-                        "no-cache"
-                    ],
-                    "Content-Type": [
-                        "application/json; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "a9401aa1-2d1b-4215-88e6-b36a12a8f448"
-                    ],
-                    "Cache-Control": [
-                        "no-cache"
-                    ],
-                    "content-length": [
-                        "428"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"kind\":\"v12.0\",\"properties\":{\"administratorLogin\":\"custodian\",\"version\":\"12.0\",\"state\":\"Ready\",\"fullyQualifiedDomainName\":\"cctestsqlserverj6y6cbbtaphs4.database.windows.net\"},\"location\":\"eastus2\",\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4\",\"name\":\"cctestsqlserverj6y6cbbtaphs4\",\"type\":\"Microsoft.Sql/servers\"}]}"
-                }
-            }
-        },
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules?api-version=2014-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "x-ms-routing-request-id": [
-                        "WESTUS2:20190503T154714Z:d3190b6e-5395-43c8-ab29-3c8b3588e621"
-                    ],
-                    "DataServiceVersion": [
-                        "3.0;"
-                    ],
-                    "x-ms-ratelimit-remaining-subscription-reads": [
-                        "11999"
-                    ],
-                    "Date": [
-                        "Fri, 03 May 2019 15:47:14 GMT"
-                    ],
-                    "x-ms-request-id": [
-                        "a963ac30-8ed2-47a3-a004-9aa149a96b04"
-                    ],
-                    "Content-Type": [
-                        "application/json; odata=minimalmetadata; streaming=true; charset=utf-8"
-                    ],
-                    "Transfer-Encoding": [
-                        "chunked"
-                    ],
-                    "X-Content-Type-Options": [
-                        "nosniff"
-                    ],
-                    "Strict-Transport-Security": [
-                        "max-age=31536000; includeSubDomains"
-                    ],
-                    "Server": [
-                        "Microsoft-HTTPAPI/2.0"
-                    ],
-                    "x-ms-correlation-request-id": [
-                        "d3190b6e-5395-43c8-ab29-3c8b3588e621"
-                    ],
-                    "Vary": [
-                        "Accept-Encoding"
-                    ],
-                    "Cache-Control": [
-                        "no-store, no-cache"
-                    ],
-                    "content-length": [
-                        "739"
-                    ]
-                },
-                "body": {
-                    "string": "{\"value\":[{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/1.2.2.128s25\",\"name\":\"1.2.2.128s25\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"1.2.2.128\",\"endIpAddress\":\"1.2.2.255\"}},{\"id\":\"/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_sqlserver/providers/Microsoft.Sql/servers/cctestsqlserverj6y6cbbtaphs4/firewallRules/AllowAllWindowsAzureIps\",\"name\":\"AllowAllWindowsAzureIps\",\"type\":\"Microsoft.Sql/servers/firewallRules\",\"location\":\"East US 2\",\"kind\":\"v12.0\",\"properties\":{\"startIpAddress\":\"0.0.0.0\",\"endIpAddress\":\"0.0.0.0\"}}]}"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_equal.json b/tools/c7n_azure/tests/cassettes/StorageTest.firewall.json
similarity index 100%
rename from tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_equal.json
rename to tools/c7n_azure/tests/cassettes/StorageTest.firewall.json
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include.json b/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Storage/storageAccounts?api-version=2019-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-cache"
-                    ],
-                    "date": [
-                        "Tue, 07 May 2019 21:17:16 GMT"
-                    ],
-                    "content-length": [
-                        "2328"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/cctstoragey6akyqpagdt3o",
-                                "name": "cctstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [],
-                                        "defaultAction": "Allow"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.5327763Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://cctstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://cctstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://cctstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://cctstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            },
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/ccipstoragey6akyqpagdt3o",
-                                "name": "ccipstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [
-                                            {
-                                                "value": "3.1.1.1",
-                                                "action": "Allow"
-                                            },
-                                            {
-                                                "value": "1.2.2.128/25",
-                                                "action": "Allow"
-                                            }
-                                        ],
-                                        "defaultAction": "Deny"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.7984096Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://ccipstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://ccipstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://ccipstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://ccipstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include_cidr.json b/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include_cidr.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_include_cidr.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Storage/storageAccounts?api-version=2019-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-cache"
-                    ],
-                    "date": [
-                        "Tue, 07 May 2019 21:17:17 GMT"
-                    ],
-                    "content-length": [
-                        "2328"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/cctstoragey6akyqpagdt3o",
-                                "name": "cctstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [],
-                                        "defaultAction": "Allow"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.5327763Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://cctstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://cctstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://cctstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://cctstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            },
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/ccipstoragey6akyqpagdt3o",
-                                "name": "ccipstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [
-                                            {
-                                                "value": "3.1.1.1",
-                                                "action": "Allow"
-                                            },
-                                            {
-                                                "value": "1.2.2.128/25",
-                                                "action": "Allow"
-                                            }
-                                        ],
-                                        "defaultAction": "Deny"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.7984096Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://ccipstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://ccipstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://ccipstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://ccipstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_equal.json b/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_equal.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_equal.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Storage/storageAccounts?api-version=2019-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-cache"
-                    ],
-                    "date": [
-                        "Tue, 07 May 2019 21:17:18 GMT"
-                    ],
-                    "content-length": [
-                        "2328"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/cctstoragey6akyqpagdt3o",
-                                "name": "cctstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [],
-                                        "defaultAction": "Allow"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.5327763Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://cctstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://cctstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://cctstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://cctstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            },
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/ccipstoragey6akyqpagdt3o",
-                                "name": "ccipstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [
-                                            {
-                                                "value": "3.1.1.1",
-                                                "action": "Allow"
-                                            },
-                                            {
-                                                "value": "1.2.2.128/25",
-                                                "action": "Allow"
-                                            }
-                                        ],
-                                        "defaultAction": "Deny"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.7984096Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://ccipstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://ccipstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://ccipstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://ccipstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_all_ranges.json b/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_all_ranges.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_all_ranges.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Storage/storageAccounts?api-version=2019-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-cache"
-                    ],
-                    "date": [
-                        "Tue, 07 May 2019 21:17:19 GMT"
-                    ],
-                    "content-length": [
-                        "2328"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/cctstoragey6akyqpagdt3o",
-                                "name": "cctstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [],
-                                        "defaultAction": "Allow"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.5327763Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://cctstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://cctstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://cctstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://cctstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            },
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/ccipstoragey6akyqpagdt3o",
-                                "name": "ccipstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [
-                                            {
-                                                "value": "3.1.1.1",
-                                                "action": "Allow"
-                                            },
-                                            {
-                                                "value": "1.2.2.128/25",
-                                                "action": "Allow"
-                                            }
-                                        ],
-                                        "defaultAction": "Deny"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.7984096Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://ccipstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://ccipstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://ccipstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://ccipstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_cidr.json b/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_cidr.json
deleted file mode 100644
--- a/tools/c7n_azure/tests/cassettes/StorageTest.test_firewall_rules_not_include_cidr.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-    "version": 1,
-    "interactions": [
-        {
-            "request": {
-                "method": "GET",
-                "uri": "https://management.azure.com/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/providers/Microsoft.Storage/storageAccounts?api-version=2019-04-01",
-                "body": null,
-                "headers": {}
-            },
-            "response": {
-                "status": {
-                    "code": 200,
-                    "message": "OK"
-                },
-                "headers": {
-                    "content-type": [
-                        "application/json"
-                    ],
-                    "cache-control": [
-                        "no-cache"
-                    ],
-                    "date": [
-                        "Tue, 07 May 2019 21:17:19 GMT"
-                    ],
-                    "content-length": [
-                        "2328"
-                    ]
-                },
-                "body": {
-                    "data": {
-                        "value": [
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/cctstoragey6akyqpagdt3o",
-                                "name": "cctstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [],
-                                        "defaultAction": "Allow"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.6265209Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.5327763Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://cctstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://cctstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://cctstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://cctstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            },
-                            {
-                                "sku": {
-                                    "name": "Standard_LRS",
-                                    "tier": "Standard"
-                                },
-                                "kind": "Storage",
-                                "id": "/subscriptions/ea42f556-5106-4743-99b0-c129bfa71a47/resourceGroups/test_storage/providers/Microsoft.Storage/storageAccounts/ccipstoragey6akyqpagdt3o",
-                                "name": "ccipstoragey6akyqpagdt3o",
-                                "type": "Microsoft.Storage/storageAccounts",
-                                "location": "southcentralus",
-                                "tags": {},
-                                "properties": {
-                                    "networkAcls": {
-                                        "bypass": "AzureServices",
-                                        "virtualNetworkRules": [],
-                                        "ipRules": [
-                                            {
-                                                "value": "3.1.1.1",
-                                                "action": "Allow"
-                                            },
-                                            {
-                                                "value": "1.2.2.128/25",
-                                                "action": "Allow"
-                                            }
-                                        ],
-                                        "defaultAction": "Deny"
-                                    },
-                                    "supportsHttpsTrafficOnly": false,
-                                    "encryption": {
-                                        "services": {
-                                            "file": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            },
-                                            "blob": {
-                                                "enabled": true,
-                                                "lastEnabledTime": "2019-05-07T21:09:30.8921592Z"
-                                            }
-                                        },
-                                        "keySource": "Microsoft.Storage"
-                                    },
-                                    "provisioningState": "Succeeded",
-                                    "creationTime": "2019-05-07T21:09:30.7984096Z",
-                                    "primaryEndpoints": {
-                                        "blob": "https://ccipstoragey6akyqpagdt3o.blob.core.windows.net/",
-                                        "queue": "https://ccipstoragey6akyqpagdt3o.queue.core.windows.net/",
-                                        "table": "https://ccipstoragey6akyqpagdt3o.table.core.windows.net/",
-                                        "file": "https://ccipstoragey6akyqpagdt3o.file.core.windows.net/"
-                                    },
-                                    "primaryLocation": "southcentralus",
-                                    "statusOfPrimary": "available"
-                                }
-                            }
-                        ]
-                    }
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/tools/c7n_azure/tests/test_cosmos_db.py b/tools/c7n_azure/tests/test_cosmos_db.py
--- a/tools/c7n_azure/tests/test_cosmos_db.py
+++ b/tools/c7n_azure/tests/test_cosmos_db.py
@@ -16,7 +16,7 @@
 
 from azure.cosmos.cosmos_client import CosmosClient
 
-from azure_common import BaseTest, arm_template
+from azure_common import BaseTest, arm_template, cassette_name
 from c7n.utils import local_session
 from c7n_azure.resources.cosmos_db import CosmosDBChildResource
 from c7n_azure.session import Session
@@ -93,6 +93,7 @@ def test_find_by_name_collection(self):
         self.assertEqual(len(resources), 1)
 
     @arm_template('cosmosdb.json')
+    @cassette_name('firewall')
     def test_firewall_rules_include(self):
         p = self.load_policy({
             'name': 'test-azure-cosmosdb',
@@ -100,12 +101,13 @@ def test_firewall_rules_include(self):
             'filters': [
                 {'type': 'firewall-rules',
                  'include': ['3.1.1.1']}],
-        })
+        }, validate=True)
         resources = p.run()
         print(resources)
         self.assertEqual(1, len(resources))
 
     @arm_template('cosmosdb.json')
+    @cassette_name('firewall')
     def test_firewall_rules_include_cidr(self):
         p = self.load_policy({
             'name': 'test-azure-cosmosdb',
@@ -118,6 +120,7 @@ def test_firewall_rules_include_cidr(self):
         self.assertEqual(1, len(resources))
 
     @arm_template('cosmosdb.json')
+    @cassette_name('firewall')
     def test_firewall_rules_not_equal(self):
         p = self.load_policy({
             'name': 'test-azure-cosmosdb',
diff --git a/tools/c7n_azure/tests/test_firewall_rules_filter.py b/tools/c7n_azure/tests/test_firewall_rules_filter.py
--- a/tools/c7n_azure/tests/test_firewall_rules_filter.py
+++ b/tools/c7n_azure/tests/test_firewall_rules_filter.py
@@ -17,8 +17,11 @@
 
 from azure_common import BaseTest
 from c7n_azure.filters import FirewallRulesFilter
+from jsonschema import ValidationError
 from netaddr import IPRange, IPNetwork, IPSet
 
+from c7n.exceptions import PolicyValidationError
+
 
 class FirewallRulesFilterTest(BaseTest):
 
@@ -69,6 +72,60 @@ def test_firewall_rules_include(self):
         actual = mock.process(satisfying_resources + non_satisfying_resources)
         self.assertEqual(satisfying_resources, actual)
 
+    def test_firewall_rules_only(self):
+        required_rules = [
+            IPNetwork('1.0.0.20/10'),
+            IPNetwork('0.0.0.0'),
+            IPRange('2.0.0.0', '2.0.0.10')]
+
+        satisfying_resources = [
+            {'rules': required_rules},
+            {'rules': [required_rules[0], required_rules[1]]}
+        ]
+
+        non_satisfying_resources = [
+            {'rules': [IPNetwork('0.0.0.1')]},
+            {'rules': required_rules + [IPRange('2.0.0.0', '2.0.0.20')]}
+        ]
+
+        mock = FirewallRulesFilterMock({'only': [
+            '0.0.0.0-0.0.0.0',
+            '1.0.0.20/10',
+            '2.0.0.0-2.0.0.10',
+            '8.8.8.8'
+        ]})
+
+        mock.validate()
+        actual = mock.process(satisfying_resources + non_satisfying_resources)
+        self.assertEqual(satisfying_resources, actual)
+
+    def test_firewall_rules_any(self):
+        required_rules = [
+            IPNetwork('1.0.0.20/10'),
+            IPNetwork('0.0.0.0'),
+            IPRange('2.0.0.0', '2.0.0.10')]
+
+        satisfying_resources = [
+            {'rules': required_rules},
+            {'rules': [required_rules[0], required_rules[1]]},
+            {'rules': required_rules + [IPRange('2.0.0.0', '2.0.0.20')]}
+        ]
+
+        non_satisfying_resources = [
+            {'rules': [IPNetwork('0.0.0.1')]}
+        ]
+
+        mock = FirewallRulesFilterMock({'any': [
+            '0.0.0.0-0.0.0.0',
+            '1.0.0.20/10',
+            '2.0.0.0-2.0.0.10',
+            '8.8.8.8'
+        ]})
+
+        mock.validate()
+        actual = mock.process(satisfying_resources + non_satisfying_resources)
+        self.assertEqual(satisfying_resources, actual)
+
     def test_firewall_rules_equal_empty(self):
         satisfying_resources = [
             {'rules': []},
@@ -115,23 +172,21 @@ def test_firewall_rules_equal(self):
         actual = mock.process(satisfying_resources + non_satisfying_resources)
         self.assertEqual(satisfying_resources, actual)
 
-    def test_firewall_no_rules(self):
-        with self.assertRaises(Exception) as context:
-            mock = FirewallRulesFilterMock({})
-            mock.validate()
-        self.assertEqual('Must have either include or equal.', str(context.exception))
-
-    def test_firewall_both_rules(self):
-        with self.assertRaises(Exception) as context:
-            mock = FirewallRulesFilterMock({'equal': [], 'include': []})
-            mock.validate()
-        self.assertEqual('Cannot have both include and equal.', str(context.exception))
+    def test_firewall_bad_schema(self):
+        p = self.load_policy({
+            'name': 'test-azure-storage',
+            'resource': 'azure.storage',
+            'filters': [{
+                'type': 'firewall-rules'
+            }],
+        })
+        with self.assertRaises(ValidationError):
+            self.load_policy(data=p, validate=True)
 
     def test_firewall_invalid_range(self):
-        with self.assertRaises(Exception) as context:
-            mock = FirewallRulesFilterMock({'equal': [], 'include': ['0.0.0.1-0.0.0.0']})
+        with self.assertRaises(PolicyValidationError):
+            mock = FirewallRulesFilterMock({'include': ['0.0.0.1-0.0.0.0']})
             mock.validate()
-        self.assertEqual('lower bound IP greater than upper bound!', str(context.exception))
 
 
 class FirewallRulesFilterMock(FirewallRulesFilter):
diff --git a/tools/c7n_azure/tests/test_sqlserver.py b/tools/c7n_azure/tests/test_sqlserver.py
--- a/tools/c7n_azure/tests/test_sqlserver.py
+++ b/tools/c7n_azure/tests/test_sqlserver.py
@@ -15,7 +15,7 @@
 
 import datetime
 
-from azure_common import BaseTest
+from azure_common import BaseTest, cassette_name
 
 
 class SqlServerTest(BaseTest):
@@ -112,6 +112,7 @@ def test_metric_database(self):
         resources = p.run()
         self.assertEqual(len(resources), 1)
 
+    @cassette_name('firewall')
     def test_firewall_rules_include_range(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
@@ -128,6 +129,7 @@ def test_firewall_rules_include_range(self):
         resources = p.run()
         self.assertEqual(1, len(resources))
 
+    @cassette_name('firewall')
     def test_firewall_rules_not_include_all_ranges(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
@@ -144,6 +146,7 @@ def test_firewall_rules_not_include_all_ranges(self):
         resources = p.run()
         self.assertEqual(0, len(resources))
 
+    @cassette_name('firewall')
     def test_firewall_rules_include_cidr(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
@@ -160,6 +163,7 @@ def test_firewall_rules_include_cidr(self):
         resources = p.run()
         self.assertEqual(1, len(resources))
 
+    @cassette_name('firewall')
     def test_firewall_rules_not_include_cidr(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
@@ -176,6 +180,7 @@ def test_firewall_rules_not_include_cidr(self):
         resources = p.run()
         self.assertEqual(0, len(resources))
 
+    @cassette_name('firewall')
     def test_firewall_rules_equal(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
@@ -192,6 +197,7 @@ def test_firewall_rules_equal(self):
         resources = p.run()
         self.assertEqual(1, len(resources))
 
+    @cassette_name('firewall')
     def test_firewall_rules_not_equal(self):
         p = self.load_policy({
             'name': 'test-azure-sql-server',
diff --git a/tools/c7n_azure/tests/test_storage.py b/tools/c7n_azure/tests/test_storage.py
--- a/tools/c7n_azure/tests/test_storage.py
+++ b/tools/c7n_azure/tests/test_storage.py
@@ -13,7 +13,7 @@
 # limitations under the License.
 from __future__ import absolute_import, division, print_function, unicode_literals
 
-from azure_common import BaseTest, arm_template
+from azure_common import BaseTest, arm_template, cassette_name
 from c7n_azure.constants import BLOB_TYPE, FILE_TYPE, QUEUE_TYPE, TABLE_TYPE
 from c7n_azure.resources.storage import StorageSettingsUtilities
 from c7n_azure.storage_utils import StorageUtilities
@@ -52,6 +52,7 @@ def test_value_filter(self):
         self.assertEqual(len(resources), 1)
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_include(self):
         p = self.load_policy({
             'name': 'test-azure-storage',
@@ -69,6 +70,79 @@ def test_firewall_rules_include(self):
         self.assertEqual(len(resources), 1)
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
+    def test_firewall_rules_any(self):
+        p = self.load_policy({
+            'name': 'test-azure-storage',
+            'resource': 'azure.storage',
+            'filters': [
+                {'type': 'value',
+                 'key': 'name',
+                 'op': 'glob',
+                 'value_type': 'normalize',
+                 'value': 'ccipstorage*'},
+                {'type': 'firewall-rules',
+                 'any': ['1.2.2.128/25', '8.8.8.8', '10.10.10.10']}],
+        })
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+
+    @arm_template('storage.json')
+    @cassette_name('firewall')
+    def test_firewall_rules_not_any(self):
+        p = self.load_policy({
+            'name': 'test-azure-storage',
+            'resource': 'azure.storage',
+            'filters': [
+                {'type': 'value',
+                 'key': 'name',
+                 'op': 'glob',
+                 'value_type': 'normalize',
+                 'value': 'ccipstorage*'},
+                {'type': 'firewall-rules',
+                 'any': ['8.8.8.8', '10.10.10.10']}],
+        })
+        resources = p.run()
+        self.assertEqual(len(resources), 0)
+
+    @arm_template('storage.json')
+    @cassette_name('firewall')
+    def test_firewall_rules_not_only(self):
+        p = self.load_policy({
+            'name': 'test-azure-storage',
+            'resource': 'azure.storage',
+            'filters': [
+                {'type': 'value',
+                 'key': 'name',
+                 'op': 'glob',
+                 'value_type': 'normalize',
+                 'value': 'ccipstorage*'},
+                {'type': 'firewall-rules',
+                 'only': ['1.2.2.128/25', '10.10.10.10']}],
+        })
+        resources = p.run()
+        self.assertEqual(len(resources), 0)
+
+    @arm_template('storage.json')
+    @cassette_name('firewall')
+    def test_firewall_rules_only(self):
+        p = self.load_policy({
+            'name': 'test-azure-storage',
+            'resource': 'azure.storage',
+            'filters': [
+                {'type': 'value',
+                 'key': 'name',
+                 'op': 'glob',
+                 'value_type': 'normalize',
+                 'value': 'ccipstorage*'},
+                {'type': 'firewall-rules',
+                 'only': ['1.2.2.128/25', '3.1.1.1', '10.10.10.10']}],
+        })
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+
+    @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_not_include_all_ranges(self):
         p = self.load_policy({
             'name': 'test-azure-storage',
@@ -86,6 +160,7 @@ def test_firewall_rules_not_include_all_ranges(self):
         self.assertEqual(0, len(resources))
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_include_cidr(self):
         p = self.load_policy({
             'name': 'test-azure-storage',
@@ -103,6 +178,7 @@ def test_firewall_rules_include_cidr(self):
         self.assertEqual(1, len(resources))
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_not_include_cidr(self):
         p = self.load_policy({
             'name': 'test-azure-storage',
@@ -120,6 +196,7 @@ def test_firewall_rules_not_include_cidr(self):
         self.assertEqual(0, len(resources))
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_equal(self):
         p = self.load_policy({
             'name': 'test-azure-storage',
@@ -137,6 +214,7 @@ def test_firewall_rules_equal(self):
         self.assertEqual(1, len(resources))
 
     @arm_template('storage.json')
+    @cassette_name('firewall')
     def test_firewall_rules_not_equal(self):
         p = self.load_policy({
             'name': 'test-azure-storage',