Azure policy in action : preventing type resources from being created
Let's say you do not want certain resources to be created. This can be controlled via Azure policy and can be scope to subscription or resource group level.
We will prevent storage account from being created in a resource group and here is how we can do it. First goto Azure Policy - Authoring - Definition and look for 'Not allowed resource types'.
Then click on "Assign Policy" and for my test, I will scope this to Resource group level.
And then provide a name to it like so,
Next, is where we specify "Resource Type" - let's select storageAccounts and then click on "Next".
And now if you switch over to "Assignments", you will notice your policy gets created.
Now it is time for test out your policy by creating a storage account in myfdrydev-rg. And then you will be hit with an error.
This is what our policy definition looks like in json
{
"properties": {
"displayName": "Not allowed resource types",
"policyType": "BuiltIn",
"mode": "All",
"description": "Restrict which resource types can be deployed in your environment. Limiting resource types can reduce the complexity and attack surface of your environment while also helping to manage costs. Compliance results are only shown for non-compliant resources.",
"metadata": {
"version": "2.0.0",
"category": "General"
},
"version": "2.0.0",
"parameters": {
"listOfResourceTypesNotAllowed": {
"type": "Array",
"metadata": {
"description": "The list of resource types that cannot be deployed.",
"displayName": "Not allowed resource types",
"strongType": "resourceTypes"
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Deny"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"in": "[parameters('listOfResourceTypesNotAllowed')]"
},
{
"value": "[field('type')]",
"exists": true
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749/versions/2.0.0",
"type": "Microsoft.Authorization/policyDefinitions/versions",
"name": "2.0.0"
}
Comments