Validate customer-supplied, security-relevant settings up front and fail deterministically with explicit errors when values/config combinations are invalid. Add tests that cover most customer-input parameters and assert the expected provisioning/result behavior and returned properties.
How to apply:
Example pattern (self-contained):
function New-SecureResource {
param(
[Parameter(Mandatory)]
[ValidateSet('Enabled','Disabled')]
[string]$PublicNetworkAccess,
# ... other customer inputs ...
[Parameter(Mandatory)]
[string]$ResourceName
)
if ($PublicNetworkAccess -eq 'Disabled') {
throw "Invalid configuration: PublicNetworkAccess is 'Disabled' for this operation. Enable it or adjust the request."
}
# proceed with create/update
}
# Tests should assert both behavior and returned fields
# e.g., for valid config:
# $config = New-SecureResource -PublicNetworkAccess 'Enabled' -ResourceName $name
# $config.ProvisioningState | Should -Be 'Succeeded'