Skip to main content

🧠 Azure Subscription Activity Log Alert for Update Key Vault Access Policy does not exist - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2026-11-14T12:03:44.237569864Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢update-key-vault-access-policy-good✔️ 199✔️ CA10__Azure_Activity_Log_Alerts__r.has(COMPLIANT)✔️ null
🟢update-key-vault-access-policy-disabled✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-wrong-operation✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-extra-filter✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-no-group✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-broken-group✔️ 299✔️ CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)✔️ null
🟢update-key-vault-access-policy-unknown-state✔️ 299✔️ CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)✔️ null
🟢update-key-vault-access-policy-none✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-mixed-good-unknown✔️ 199✔️ CA10__Azure_Activity_Log_Alerts__r.has(COMPLIANT)✔️ null
🟢update-key-vault-access-policy-mixed-bad-unknown✔️ 299✔️ CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)✔️ null
🟢update-key-vault-access-policy-deleted-alert✔️ 300✔️ otherwise✔️ null
🟢update-key-vault-access-policy-narrow✔️ 299✔️ CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/policy.yamlC51B42713F66366F1DB90F9941EA8ADD
Open/ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yamlE293021617FE4D32BABB53B1E456D6D5
Open/ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/test-data.json57FFA1FFA0D01ED49B6298F331F2B32E
Open/types/CA10__CaAzureActivityLogAlert__c/object.extracts.yaml8A1FFCB1A6A450C933A1A1E63AD96EA2
Open/types/CA10__CaAzureAccount__c/object.extracts.yaml3FFDE42186EE2CD29391A3CBD86FC4C0

Available Commands​

repo-manager policies generate FULL /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy/prod.logic.yaml

Content​

Open File

---
inputType: CA10__CaAzureAccount__c
testData:
  - file: test-data.json
conditions:
  - status: COMPLIANT
    currentStateMessage: An enabled subscription-wide update key vault access policy alert has an action
      group.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: COMPLIANT
  - status: UNDETERMINED
    currentStateMessage: A candidate update key vault access policy alert has unresolved scope or configuration.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: UNDETERMINED
otherwise:
  status: INCOMPLIANT
  currentStateMessage: No qualifying subscription-wide update key vault access policy alert exists.
  remediationMessage: Create an enabled Administrative Microsoft.KeyVault/vaults/accessPolicies/write
    alert covering the subscription, with an action group and no extra filters.
relatedLists:
  - relationshipName: CA10__Azure_Activity_Log_Alerts__r
    importExtracts:
      - file: /types/CA10__CaAzureActivityLogAlert__c/object.extracts.yaml
      - file: /types/CA10__CaAzureAccount__c/object.extracts.yaml
    conditions:
      - status: INAPPLICABLE
        currentStateMessage: This alert is disabled.
        check:
          IS_EQUAL:
            left:
              EXTRACT: CA10__enabledStatus__c
            right:
              TEXT: Disabled
      - status: UNDETERMINED
        currentStateMessage: The alert enablement state is unexpected.
        check:
          NOT:
            arg:
              IS_EQUAL:
                left:
                  EXTRACT: CA10__enabledStatus__c
                right:
                  TEXT: Enabled
      - status: INAPPLICABLE
        currentStateMessage: This alert does not cover the required unfiltered Administrative operation.
        check:
          NOT:
            arg:
              JSON_QUERY_BOOLEAN:
                arg:
                  EXTRACT: caJsonFrom__conditionJson__c
                expression: length(allOf) == `2` && length(allOf[?field=='category' && equals=='Administrative'])
                  == `1` && length(allOf[?field=='operationName' && equals=='Microsoft.KeyVault/vaults/accessPolicies/write'])
                  == `1`
                undeterminedIf:
                  evaluationError: The collected JSON cannot be evaluated.
                  resultTypeMismatch: The JSON query did not return a boolean.
      - status: INAPPLICABLE
        currentStateMessage: This alert is scoped to a different subscription.
        check:
          NOT:
            arg:
              CONTAINS:
                arg:
                  EXTRACT: CA10__scopes__c
                search:
                  EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
      - status: UNDETERMINED
        currentStateMessage: The alert scope needs manual review for subscription-wide coverage.
        check:
          NOT:
            arg:
              AND:
                args:
                  - STARTS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        TEXT: /subscriptions/
                  - ENDS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
                  - IS_EQUAL:
                      left:
                        SIZE:
                          arg:
                            SET_FROM:
                              arg:
                                EXTRACT: CA10__scopes__c
                              separator: /
                      right:
                        NUMBER: 2
      - status: COMPLIANT
        currentStateMessage: This alert covers the operation across the subscription and has an action
          group.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: COMPLIANT
      - status: UNDETERMINED
        currentStateMessage: The configured action group cannot be resolved.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: UNDETERMINED
    otherwise:
      status: INAPPLICABLE
      currentStateMessage: This alert has no current action group.
    relatedLists:
      - relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
        conditions:
          - status: COMPLIANT
            currentStateMessage: The alert action group is resolved.
            check:
              NOT_EMPTY_LOOKUP: CA10Z1__actionGroup__r
        otherwise:
          status: UNDETERMINED
          currentStateMessage: The configured alert action group is unavailable.