Azure resource filtering should not be case-sensitive

[ikraemer-dd]

Azure resource filtering should not be case-sensitive

[kapilt]

value_type: normalize is intended to support this use case.

[ikraemer-dd]

Hi!
My use case is write a policy finding all resources that match a filter, but to exclude a list of known resources. These known exceptions are known by resource names, which should be compared in a case-insensitive way, as per Azure doc.
Hence, my policy looks like:

policies:
  - name: storage-account-lower-case
    description: |
      Find a storage accounts (lower cases)
    resource: azure.storage
    filters:
      - type: value
        key: id
        op: not-in
        value: 
        - /subscriptions/xxx/resourcegroups/yyy/providers/microsoft.storage/storageaccounts/zzz
        - /subscriptions/xxx/resourcegroups/yyy/providers/microsoft.storage/storageaccounts/aaa

I could not find how to make value_type: normalize option work with a list of values. Is there a way?

[kapilt]

the normalize is done on the resource value, which is a string in this case even when the value in the policy is an array. what issue are you seeing?

[ikraemer-dd]

Indeed, i missed this! The following policy addresses exactly my use-case.

policies:
  - name: storage-account-matching-a-list
    resource: azure.storage
    filters:
      - type: value
        key: id
        op: in
        value: 
        - /subscriptions/xxx/resourcegroups/yyy/providers/microsoft.storage/storageaccounts/zzz
        - /subscriptions/xxx/resourcegroups/yyy/providers/microsoft.storage/storageaccounts/aaa
        value_type: normalize

Thank you!