Local Rule Exclusion when using a Baseline

[paulmccrady]

Is excluding rules "locally" expected to work when using a baseline?
i.e. we have a ps-rule.yaml config file that we have declared a baseline but we also might have a usecase to also configuring rule: exclude within the same file.

It doesnt work, as in the rule is not excluded. We have rule exclusions defined in the Baseline which do work, just wondering if this is by design , i.e. all exclusions would be in the baseline and local ones are ignored.

[BernieWhite]

@paulmccrady Thanks for your question.

A baseline is declared with in <name>.Rule.yaml. A baseline is referenced within PSRule e.g. via -Baseline parameter for PowerShell cmdlets or baseline: property/ input of GitHub/Azure Pipelines.

The baseline will select rules to execute which can be excluded by the rule.exclude property set within ps-rule.yaml or the spec.rule.exclude property of the baseline. If the rule exists in either it will be excluded and not executed.

---

In terms of the question the short answer is yes you can exclude rules from ps-rule.yaml when using a baseline. This is the common expected case. i.e. the baseline defines a set of rules but some may not apply to your environment or the specific repo so these are excluded.

However, I'm not 100% clear on your environment setup. Points to note:

• Putting a baseline definition side by side with a options configuration in a ps-rule.yaml or another *.Rule.yaml is not supported. Each file serves a discrete purpose.
  • ps-rule.yaml supports a single top-level options object. Example
  • *.Rule.yaml supports zero to many resource definitions (baselines/ selectors/ rules/ suppression groups). Example
• Setting the rule.baseline property is not supported in ps-rule.yaml as noted in the docs.
• rule.exclude does not support wildcards. An exclusion can be made by the rule name i.e. Azure.ACR.AdminUser or a fully qualified Id if the name is ambiguous i.e. PSRule.Rules.Azure\Azure.ACR.AdminUser. Name and Id are exact but case-insensitive.

---

Hopefully this information helps answer your question. If not, are you able to provide an example or additional detail?

[paulmccrady]

ok, so i can see the rule.exclude in the ps options. I use Assert-PSRule with the following arguments
-Baseline
-ErrorAction
-InputPath
-Option
-OutputFormat
-OutputPath

I exclude Azure.APIM.Ciphers (as well as loads of other rules in the baseline). Rule ran fine and all passed.
I removed the cipher rule and got an error (as expected).
I placed the cipher exclusion in the ps-rule,yaml file and still got the same error (when I expected to pass)

[paulmccrady]

Using v2.9.0 and PSRule.Rules.Azure 1.34.2

[BernieWhite]

OK. Let me try a reproduction.

[BernieWhite]

@paulmccrady After doing some more digging and testing, I think the behaviour you are experiencing is intended (to preserve other behaviour) but agree it's not ideal in your case and could be confusing.

The problem stems from:

When baseline options are set, PSRule uses the following order to determine precedence.

• Parameter - -Name and -Tag.
• Explicit - A named baseline specified with -Baseline.
• Workspace - Included in ps-rule.yaml or specified on the command line with -Option.
• Module - A baseline object included in a .Rule.yaml or .Rule.json file.

After precedence is determined, baselines are merged and null values are ignored.

So in this case:

• You are explicitly setting the baseline with -Baseline.
• You have rule.exclude set in both the baseline and ps-rule.yaml
• The rule.exclude option of the baseline is overriding the rule.exclude setting from the ps-rule.yaml.

---

We'll add it to the backlog to see if there is another path to make this experience better.

In terms of a workaround for current state:

1. Use rule.include / rule.tag / rule.labels to select only the rule you need in the baseline, without setting rule.exclude. This will keep rule.exclude free to be used in ps-rule.yaml.
2. Use a suppression group to suppress instead of exclude rules in either the workspace repo where PSRule is run or in the repo where the baseline is stored.

If your testing doesn't confirm this behaviour then let me know.

Using rule.include

The rules that you want to include might be not be easily selectable by using rule.tag or rule.labels but you can generate a baseline by adding a PowerShell filter to prevent having to manually specify rule.include. See https://github.com/Azure/PSRule.Rules.Azure/blob/main/scripts/security-baseline.ps1 for an example.

Using a suppression group

For creating a suppression group, set the excluded rules under spec.rule, and set a if condition that always executes.

---
# Synopsis: Example 1 reason
apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Example
spec:
  rule:
    - Azure.Resource.AllowedRegions
  if:
    value: true
    equals: true

---
# Synopsis: Example 2 reason
apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Example
spec:
  rule:
    - Azure.Resource.AllowedRegions
  if:
    type: .
    startsWith: Microsoft.

You may also want to set execution.ruleSuppressed option to Ignore to hide any suppression warnings.

[paulmccrady]

ok, many thanks for investigating. This makes sense.

[BernieWhite]

Logged as microsoft/PSRule#1783.