E6 — Access Review Automation: Test Runbook¶

Asset: Access Review Automation (E6) Location: apps/access-review/ + .github/workflows/access-review.yml Owner: SnowOps (SO) Milestone: M4

Overview¶

E6 collects Azure RBAC role assignments on a subscription, renders a quarterly review.csv for human sign-off, and opens/updates a review ticket via E7 (snowops-ticket). Scheduled quarterly via access-review.yml.

Part A — Offline: unit tests¶

cd apps/access-review
npm ci
npm test

Expected: All tests pass (collector, review builder, render). Tests cover: - FixtureCollector returning assignments unchanged - buildReview sorting (high-privilege first) - renderCsv: header row, data rows, RFC 4180 escaping, empty action column - renderMarkdown: period heading, high-privilege section, "None found" guard - quarterLabel: Q1–Q4 for boundary months

Part B — Offline: TypeScript type-check¶

cd apps/access-review
npm run typecheck

Expected: No type errors.

Part C — Live: dry-run workflow dispatch¶

gh workflow run access-review.yml \
  -f dry_run=true \
  -f ticket_platform=dry-run

Expected: Workflow completes. Upload artifact access-review-* contains review.json, review.csv, and summary.md.

Part D — Live: full quarterly review (requires Azure + ticket credentials)¶

Prerequisites: - az login or OIDC secrets: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID - Ticket secrets set for chosen platform (e.g. GITHUB_TOKEN for github)

gh workflow run access-review.yml \
  -f dry_run=false \
  -f ticket_platform=github

Expected: 1. Workflow completes without errors 2. compliance/access-reviews/<period>/ contains the three review files (committed) 3. A GitHub issue (or ticket on chosen platform) is opened with the summary.md body 4. The ticket title includes [Access Review] <period> 5. The issue is tagged access-review,quarterly

Sign-Off Block¶

Step	Executed by	Date	Result
Part A (unit tests)			⬜
Part B (typecheck)			⬜
Part C (dry-run dispatch)			⬜
Part D (live quarterly run)			⬜

Signed off: _____ Date: ___

Failure Modes¶

Failure	Cause	Remediation
`az rest` fails: 403	Insufficient Azure permissions	Ensure the OIDC SP has Reader on the subscription
`snowops-ticket` not found	E7 not installed	Run `npm run build && npm link` in `apps/ticket-platform`
Empty `review.csv`	No role assignments found	Check subscription ID is correct and has RBAC assignments
Ticket not opened	Missing ticket secrets	Check platform-specific env vars in repository secrets