The powershell way to validate Azure infrastructure
Tags: azure, powershell, devops
Published: 2023-02-19 12:10:48

---
title: The powershell way to validate Azure infrastructure
published: true
description: A suite of rules to validate Azure resources and infrastructure as code (IaC) using PSRule.
tags: azure, powershell, devops
# cover_image: https://direct_url_to_image.jpg
# Use a ratio of 100:42 for best results.
# published_at: 2023-02-19 10:29 +0000
---
One of the most important challenge in the cloud era is to use the flexibility provided in the most productive way possible for our projects. To help about this Microsoft provides a set of guiding tenets called ***Azure Well-Architected Framework***, that can be used to improve the quality of a workload.

The framework consists of five pillars of architectural excellence:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h1yt1bl24zbu1hhr3eye.jpg)

The set of rules are available directly on [Microsoft documentation](https://learn.microsoft.com/en-gb/azure/architecture/framework).

To validate an infrastructure about the following of rules, we can use [Azure Advisor](https://learn.microsoft.com/en-us/azure/advisor/advisor-overview) which is able to make an assessment review of the resources provisioned by generating a set of recommendations.

As devops I prefer an alternative way based on Powershell called [PSRule for Azure](https://github.com/Azure/PSRule.Rules.Azure) which provides a suite of rules to validate resources and infrastructure as code (IaC) using PSRule. It provides two methods for analyzing Azure resources:

- _Pre-flight_ - Before resources are deployed from Azure Resource Manager templates.
- _In-flight_ - After resources are deployed to an Azure subscription.

Below an example of In-flight use:

```Powershell
# STEP 1: Install PSRule.Rules.Azure from the PowerShell Gallery
Install-Module -Name 'PSRule.Rules.Azure' -Scope CurrentUser;

# STEP 2: Authenticate to Azure, only required if not currently connected
Connect-AzAccount;

# Confirm the current subscription context
Get-AzContext;

# STEP 3: Exports a resource graph stored as JSON for analysis
Export-AzRuleData -OutputPath 'out/templates/';

# STEP 4: Run analysis against exported data
Invoke-PSRule -InputPath 'out/templates/' -Module 'PSRule.Rules.Azure' -As Summary;

RuleName                            Pass  Fail  Outcome
--------                            ----  ----  -------
Azure.ACR.MinSku                    0     1     Fail
Azure.AppService.PlanInstanceCount  0     1     Fail
Azure.AppService.UseHTTPS           0     2     Fail
Azure.Resource.UseTags              73    36    Fail
Azure.SQL.ThreatDetection           0     1     Fail
Azure.SQL.Auditing                  0     1     Fail
Azure.Storage.UseReplication        1     7     Fail
Azure.Storage.SecureTransferRequ... 2     6     Fail
Azure.Storage.SoftDelete            0     8     Fail
```

Some examples of PSRule for Azure module usage are:

- [Validate Azure resources from templates with Azure Pipelines](https://github.com/Azure/PSRule.Rules.Azure/blob/main/docs/scenarios/azure-pipelines-ci/azure-pipelines-ci.md)
- [Validate Azure resources from templates with continuous integration (CI)](https://github.com/Azure/PSRule.Rules.Azure/blob/main/docs/scenarios/azure-template-ci/azure-template-ci.md)
- [Create a custom rule to enforce Resource Group tagging](https://azure.github.io/PSRule.Rules.Azure/customization/enforce-custom-tags/)
- [Create a custom rule to enforce code ownership](https://azure.github.io/PSRule.Rules.Azure/customization/enforce-codeowners/)