AzureDevOps project Severityhigh builtIn

Description

Checks allow you to manage how this resource is used. Extend pipeline protection by configuring checks on your production resources. Most pipelines need a second set of eyes look over changes (especially to the pipeline itself) before deploying to production. Checks allow you to pause the pipeline run until certain conditions are met. https://learn.microsoft.com/en-us/azure/devops/pipelines/process/approvals https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints

Recommendation

1. Navigate to Project Settings. 
2. Open the Service connections link under Pipelines. 
3. Select a service connection. 
4. Click on 'Approvals and checks' tab. 
5. Click on 'Add your first check' / 'View all checks' to add one or more checks. 
6. Click 'Create' to add the check.

Policy Rule

{
  "target": "ADOProjectCheckConfiguration",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectCheckConfiguration",
        "property": "Resource.Type",
        "operator": "equals",
        "value": "endpoint"
      },
      {
        "resource": "ADOProjectCheckConfiguration",
        "property": "Resource.Name",
        "operator": "match",
        "value": "$(POLICY_VAR_PROJECT_PROD_SERVICE_CONNECTION_PATTERNS)"
      },
      {
        "resource": "ADOProjectCheckConfiguration",
        "property": "HasChecks",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}