Can't update policy settings in the Azsk task in Azure devops

Question

In my azure devops (vsts) pipeline i added the task "Azsk". I don't want the default Pass/Failed controls that the Azsk team provided so I am trying to add custom controls into my task. So far this didn't worked.

I tried following tutorial to create a custom control settings but at the step I am kind of stuck. Here I need to add a variable with the blob url for the custom settings, but the way the tutorial says is not working , so I got this working with adding an blob url from the azure portal to access the Azsk.json file.

In my azure devops pipeline I got the folowwing error when I try to deploy this:

2018-11-13T13:25:41.5141122Z The property 'OnlinePolicyList' cannot be found on this object. Verify that the property exists.
2018-11-13T13:25:41.5141273Z At 
2018-11-13T13:25:41.5141355Z C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Helpers\ConfigurationHelper.ps1:344 
2018-11-13T13:25:41.5141417Z char:7
2018-11-13T13:25:41.5141492Z + ...          if([ConfigurationHelper]::ServerConfigMetadata.OnlinePolicyL ...
2018-11-13T13:25:41.5141593Z +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2018-11-13T13:25:41.5141654Z     + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException
2018-11-13T13:25:41.5141728Z     + FullyQualifiedErrorId : PropertyNotFoundStrict
2018-11-13T13:25:41.5141775Z  
2018-11-13T13:25:41.5141816Z 
2018-11-13T13:25:41.5141903Z StackTrace: at IsPolicyPresentOnServer, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Helpers\ConfigurationHelper.ps1: line 344
2018-11-13T13:25:41.5142010Z at LoadServerConfigFile, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Helpers\ConfigurationHelper.ps1: line 86
2018-11-13T13:25:41.5142097Z at LoadAzSKSettings, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Models\AzSKSettings.ps1: line 113
2018-11-13T13:25:41.5142197Z at GetInstance, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Models\AzSKSettings.ps1: line 45
2018-11-13T13:25:41.5142296Z at GetAzSKSettings, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Managers\ConfigurationManager.ps1: line 14
2018-11-13T13:25:41.5142403Z at GetAzSKConfigData, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Managers\ConfigurationManager.ps1: line 9
2018-11-13T13:25:41.5142667Z at ValidateOrgPolicyOnSubscription, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Abstracts\CommandBase.ps1: line 340
2018-11-13T13:25:41.5142772Z at CommandBase, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Abstracts\CommandBase.ps1: line 28
2018-11-13T13:25:41.5142858Z at SVTCommandBase, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Abstracts\SVTCommandBase.ps1: line 20
2018-11-13T13:25:41.5142961Z at ServicesSecurityStatus, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\Framework\Core\SVT\ServicesSecurityStatus.ps1: line 5
2018-11-13T13:25:41.5145085Z at Get-AzSKAzureServicesSecurityStatus, C:\Users\VssAdministrator\Documents\WindowsPowerShell\Modules\AzSK\3.7.0\SVT\SVT.ps1: line 211
2018-11-13T13:25:41.5145198Z at , : line 1
2018-11-13T13:25:41.5145289Z at , D:\a\_tasks\AzSKSVTs_c016cc55-9914-4a9c-b9df-f24d6f9a40f6\3.0.6\AzSKSVTRuntime.ps1: line 211
2018-11-13T13:25:41.5145402Z at , : line 1
2018-11-13T13:25:41.5145465Z at , : line 22
2018-11-13T13:25:41.5145544Z at , : line 18
2018-11-13T13:25:41.5145605Z at , : line 1
2018-11-13T13:25:41.7031832Z ##[error]Could not perform AzSK SVTs scan. Please check if task configurations are correct.
2018-11-13T13:25:41.7818512Z ##[error]Unable to perform security scan. Please check task configurations/variables
2018-11-13T13:25:41.9031160Z ##[section]Finishing: AzSK_SVTs

On first sight this is something with the code inside the module that are not getting the right libraries. But I don't now what this has to do with my custom control settings.

Second part of the question: I can't still see how i can add custom controls inside this way to decide for myself if I want to let pass a control or not. Something like this. This worked for me when I installed the module on my local pc and changed the controlsettings.json file . But I have no clue how this can be set or how my pipeline task implement this in the Azsk task.

Is there someone who is familiar with the task of Azsk and 1)knows what my error is saying. And 2) Know how you can implement custom scans settings in your CI/CD pipeline ?

user_10732170 · Answer

You are linking to the wrong file. Your blob URL needs to point to ServerConfigMetadata.json, not ControlSettings.json. That said, I still could not get it to work.

user_6351302 · Answer

I totally forgot about this question. First problem : the settings in my pipeline were wrong because the link to my blob storage was not exactly the same they were some differences , after I looked closely and followed again every step from this part of the tutorial(https://github.com/azsk/DevOpsKit-docs/blob/master/07-Customizing-AzSK-for-your-Org/Readme.md#using-cicd-extension-with-custom-org-policy)

Second problem: I found how to set some controls to past, you have to add an attestation status to a control. To make the control 'notanissue'. This again after some digging in the documentation: https://github.com/azsk/DevOpsKit-docs/tree/master/00c-Addressing-Control-Failures

I'am going to leave the question here because as I see there are still some people with this problem and I hope this solution I found will sue for your struggles (problem)

PS: I know that my answers are referring to links that can not be accessible in the future. But as this is the only documentation for AzSK and the answers to my question is a total tutorial I can not do more than provide the links.

Can't update policy settings in the Azsk task in Azure devops

2 Answers