azure-policy VS shellharden

Reference: https://github.com/Azure/azure-policy

I just came across this post over in the Azure subreddit and it gave me a good idea on one way to deal with rogue Azure subscriptions - just have them default into a Management Group where a policy is in-place that basically denies use of any and all services.

Oooo, that's a nice trick for the use of the root management group which usually has best practice to leave empty. I like that a lot! Could maybe pair that with the "deny all resource types" policy sample, and then even if someone does create a new subscription it's pretty much 100% neutered until someone pulls it out of the root management group and places it somewhere else.

Found a 2018 Github article - https://github.com/Azure/azure-policy/issues/102

MS Repo https://github.com/Azure/azure-policy/tree/master/built-in-policies/policyDefinitions

I can see here that is expecting azure-policy/AzureWindowsBaseline.mof at master · Azure/azure-policy · GitHub: "LOCAL SERVICE, NETWORK SERVICE". However, that would exclude the web app pools.

Azure shared with us a GitHub repository contains built-in samples of Azure Policies that can be used as reference for creating and assigning policies to your subscriptions and resource groups.

The only real way you'll be able to do this is via an Azure Policy, alongside a deny effect - where your policy would restrict based on the type field, with the values passed in via an array parameter (example)

Everytime I see Shellcheck coming up, I have to mention shellharden[0] written by a colleague of mine. It is basically shellcheck but it applies the suggested changes automatically.

0: https://github.com/anordal/shellharden

Also worth mentioning shellharden

See also:

* https://www.shellcheck.net/ — linting tool to avoid common mistakes and improve your script

* Bash Practices: https://mywiki.wooledge.org/BashGuide/Practices

* Bash Pitfalls: https://mywiki.wooledge.org/BashPitfalls

* safe ways to do things in bash: https://github.com/anordal/shellharden/blob/master/how_to_do...

* better scripting: https://robertmuth.blogspot.in/2012/08/better-bash-scripting...

* robust scripting: https://www.davidpashley.com/articles/writing-robust-shell-s...

There is shellcheck, and shellharden which is a strict version of it. There are similar stuff here, some that also help with your editor. You can also use a docker version of shfmt. See here for a quick tutorial on shfmt.

Regarding linters, there are several of them in most languages.For bash, there is Shellcheck or a more strict (and sometimes confusing) Shellharden to do exactly what you want.

For example, shellharden looks awesome.