[Built-in Rule] Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign

Azure policy: https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json

{
    "name": "ServiceFabric_ClusterProtectionLevel_EncryptAndSign",
    "description": "Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign",
    "recommendation": "Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed",
    "helpUri": "https://github.com/Azure/template-analyzer/docs/built-in-bpa-rules.md/#service-fabric-clusters-should-have-the-clusterprotectionlevel-property-set-to-encryptandsign",
    "evaluation": {
      "resourceType": "Microsoft.ServiceFabric/clusters",
      "allOf": [
        {
          "path": "properties.fabricSettings[*].name",
          "equals": "Security"
        },
        {
          "path": "properties.fabricSettings[*].parameters[*].name",
          "equals": "ClusterProtectionLevel"
        },
        {
          "path": "properties.fabricSettings[*].parameters[*].value",
          "equals": "EncryptAndSign"
        }
      ]
    }
}

[JohnathonMohr]

I see. You might be right. The assertions may need to be split up even more. We’ll need to reevaluate once not is ready.

[VeraBE]

I understood that, I’m confused about this part: “return passed if for all the fabricSettings is true that the name is Security and -the rest of the property in the second element of the allOf-”. The documentation on the wildcard operator says that “If two or more are found, the operator evaluates each path individually and the results are logically 'and’ed together.”. I understand that we want to check only for the one setting that has Security as a name