Run policy checks against the resolved module.
Routes to the engine matching the module's ecosystem:
- bicep -> PSRule.Rules.Azure against tokenized defaults and waf-aligned tests, with required and advisory baselines
- terraform -> Conftest with APRL and AVMSEC bundles
The ecosystem is determined by Get-AvmModuleContext, which honours the .avm/context.psd1 override file and the -Ecosystem filter. Bicep policy checks use packaged ps-rule.yaml and rules/ assets under Resources/bicep/psrule. Exact PSRule and PSRule.Rules.Azure versions, including pinned dependencies and repository overrides, are resolved and prepared by the shared managed-tool installer. Bicep policy runs offline without Azure authentication or secrets. If VALIDATE_SUBSCRIPTION_IDS or TEST_SUBSCRIPTION_IDS is set, the first entry matching the exact module path in the required root .reserved-test-subscriptions.json map is used; unmapped modules use General, including untagged entries. Pool variables precede secrets. VALIDATE_SUBSCRIPTION_ID is a fallback only for General without a pool. Optional overrides are VALIDATE_TENANT_ID, VALIDATE_MANAGEMENT_GROUP_ID (or ARM_MGMTGROUP_ID), and localToken_* variables for tokens used by the selected tests. Without configured IDs, policy uses public template-expansion placeholders: subscriptionId 11111111-1111-4111-8111-111111111111, tenantId 22222222-2222-4222-8222-222222222222 and managementGroupId avm-policy. No real subscription or tenant is required. Reserved modules can use these offline defaults without a pool; configured pools must still match their tag. These defaults never flow into deployment commands. namePrefix defaults to the portable public value 'gci'; localToken_namePrefix or TOKEN_NAMEPREFIX can override it. Missing custom tokens or uninspectable results fail rather than skip.
Terraform checks Azure authentication after pre.ps1 and .env loading, before init/plan. Supply ARM_* credentials (including a subscription) or an authenticated Azure CLI on PATH with an enabled subscription. CLI subscription and tenant IDs are passed only to child processes; the check never signs in or changes the selected CLI account. Providers still validate credentials and resource permissions.
Terraform post-hook failure or interrupted cleanup retains recovery staging beneath the AVM cache (AVM_HOME/cache when overridden). The warning identifies the local path; it can contain sensitive state, plans, and environment files and must not be uploaded. Recover fixture resources before manually removing retained staging. Successful cleanup removes staging even when planning or policy evaluation fails. The original error remains terminating. When both evaluation and the post hook fail, Exception.Data['AvmPolicyPostError'] retains the post ErrorRecord; Exception.Data['AvmPolicyStagePath'] identifies staging.
Routed by the dispatcher: 'avm check policy'.
avm check policy
Invoke-AvmCheckPolicy [[-Path] <string>] [-Ecosystem <string>] [-AllowPathFallback] [-ThrottleLimit <int>] [-Example <string[]>] [-Baseline <string[]>] [-SkipModuleVersionCheck] [<CommonParameters>]When set, accept a PATH-resolved tool binary that self-reports the lock-pinned version.
| Property | Value |
|---|---|
| Type | Switch |
| Required | false |
| Position | named |
| Default value | False |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Bicep-only subset of Azure.Pillar.Reliability, CB.AVM.WAF.Security, Azure.Default and Azure.Pillar.Security. Required and advisory outcomes are unchanged. Omit to run all four baselines.
| Property | Value |
|---|---|
| Type | String[] |
| Required | false |
| Position | named |
| Default value | |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Force the ecosystem selector. Defaults to 'auto'.
| Property | Value |
|---|---|
| Type | String |
| Required | false |
| Position | named |
| Default value | auto |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Bicep-only exact module-relative main.test.bicep paths under tests/e2e, including child modules. Omit to select defaults and waf-aligned tests. Unmatched paths fail before evaluation.
| Property | Value |
|---|---|
| Type | String[] |
| Required | false |
| Position | named |
| Default value | |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Working directory whose enclosing module to check. Defaults to the current location.
| Property | Value |
|---|---|
| Type | String |
| Required | false |
| Position | 1 |
| Default value | $PWD.Path |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Skip the PowerShell Gallery check that otherwise stops the command when a newer Avm.Authoring version is available. Writes a warning once.
| Property | Value |
|---|---|
| Type | Switch |
| Required | false |
| Position | named |
| Default value | False |
| Accept pipeline input | false |
| Accept wildcard characters | false |
Maximum number of independent Terraform examples to evaluate at once. Defaults to four. Bicep policy checks ignore this value.
| Property | Value |
|---|---|
| Type | Int32 |
| Required | false |
| Position | named |
| Default value | 4 |
| Accept pipeline input | false |
| Accept wildcard characters | false |
avm check policyInvoke-AvmCheckPolicy -Path C:\repos\my-bicep-module -Ecosystem bicepavm check policy --example tests/e2e/defaults/main.test.bicep --baseline Azure.Pillar.Reliabilitypscustomobject from the engine: Engine, Tool, ToolPath, ToolSource, Status, Issues.