---
inputType: CA10__CaAzureAccount__c
testData:
  - file: test-data.json
conditions:
  - status: COMPLIANT
    currentStateMessage: An enabled subscription-wide update key vault access policy alert has an action
      group.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: COMPLIANT
  - status: UNDETERMINED
    currentStateMessage: A candidate update key vault access policy alert has unresolved scope or configuration.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: UNDETERMINED
otherwise:
  status: INCOMPLIANT
  currentStateMessage: No qualifying subscription-wide update key vault access policy alert exists.
  remediationMessage: Create an enabled Administrative Microsoft.KeyVault/vaults/accessPolicies/write
    alert covering the subscription, with an action group and no extra filters.
relatedLists:
  - relationshipName: CA10__Azure_Activity_Log_Alerts__r
    importExtracts:
      - file: /types/CA10__CaAzureActivityLogAlert__c/object.extracts.yaml
      - file: /types/CA10__CaAzureAccount__c/object.extracts.yaml
    conditions:
      - status: INAPPLICABLE
        currentStateMessage: This alert is disabled.
        check:
          IS_EQUAL:
            left:
              EXTRACT: CA10__enabledStatus__c
            right:
              TEXT: Disabled
      - status: UNDETERMINED
        currentStateMessage: The alert enablement state is unexpected.
        check:
          NOT:
            arg:
              IS_EQUAL:
                left:
                  EXTRACT: CA10__enabledStatus__c
                right:
                  TEXT: Enabled
      - status: INAPPLICABLE
        currentStateMessage: This alert does not cover the required unfiltered Administrative operation.
        check:
          NOT:
            arg:
              JSON_QUERY_BOOLEAN:
                arg:
                  EXTRACT: caJsonFrom__conditionJson__c
                expression: length(allOf) == `2` && length(allOf[?field=='category' && equals=='Administrative'])
                  == `1` && length(allOf[?field=='operationName' && equals=='Microsoft.KeyVault/vaults/accessPolicies/write'])
                  == `1`
                undeterminedIf:
                  evaluationError: The collected JSON cannot be evaluated.
                  resultTypeMismatch: The JSON query did not return a boolean.
      - status: INAPPLICABLE
        currentStateMessage: This alert is scoped to a different subscription.
        check:
          NOT:
            arg:
              CONTAINS:
                arg:
                  EXTRACT: CA10__scopes__c
                search:
                  EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
      - status: UNDETERMINED
        currentStateMessage: The alert scope needs manual review for subscription-wide coverage.
        check:
          NOT:
            arg:
              AND:
                args:
                  - STARTS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        TEXT: /subscriptions/
                  - ENDS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
                  - IS_EQUAL:
                      left:
                        SIZE:
                          arg:
                            SET_FROM:
                              arg:
                                EXTRACT: CA10__scopes__c
                              separator: /
                      right:
                        NUMBER: 2
      - status: COMPLIANT
        currentStateMessage: This alert covers the operation across the subscription and has an action
          group.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: COMPLIANT
      - status: UNDETERMINED
        currentStateMessage: The configured action group cannot be resolved.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: UNDETERMINED
    otherwise:
      status: INAPPLICABLE
      currentStateMessage: This alert has no current action group.
    relatedLists:
      - relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
        conditions:
          - status: COMPLIANT
            currentStateMessage: The alert action group is resolved.
            check:
              NOT_EMPTY_LOOKUP: CA10Z1__actionGroup__r
        otherwise:
          status: UNDETERMINED
          currentStateMessage: The configured alert action group is unavailable.