Share via

Azure Policy Deployifnotexist Nested Templates and Parameters

Christophe Humbert 101 Reputation points
2024-05-15T06:37:44.1466667+00:00

Hello,

I have a policy to deploy an alert on all subs not having it (as you can not create alert with MG group scope for now)...And I was not able to have parameters bein taken into account from the Policy down to the two nested templates for the deployment...I had to repeat the default value to have the remediation task not failing (i.e. the deployement).

Any hints would be nice

{
  "properties": {
    "displayName": "Alert for VNET Peering",
    "policyType": "Custom",
    "mode": "All",
    "metadata": {
      "category": "Monitoring",
      "createdBy": "USERID",
      "createdOn": "2024-05-07T08:32:23.1194688Z",
      "updatedBy": null,
      "updatedOn": null
    },
    "version": "1.0.0",
    "parameters": {
      "enabled": {
        "type": "String",
        "metadata": {
          "displayName": "Alert State",
          "description": "Alert state for the alert"
        },
        "allowedValues": [
          "true",
          "false"
        ],
        "defaultValue": "true"
      },
      "alertResourceGroupName": {
        "type": "String",
        "metadata": {
          "displayName": "Resource Group Name",
          "description": "Resource group the alert is placed in"
        },
        "defaultValue": "rg-amba-monitoring-001"
      },
      "MonitorDisable": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled"
        },
        "defaultValue": "MonitorDisable"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks/"
          },
          {
            "field": "[concat('tags[', parameters('MonitorDisable'), ']')]",
            "notEquals": "true"
          }
        ]
      },
  
"then": {
        "effect": "deployIfNotExists",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "type": "Microsoft.Insights/activityLogAlerts",
          "name": "AlertVNETPeering",
          "existenceScope": "resourceGroup",
          "resourceGroupName": "[parameters('alertResourceGroupName')]",
          "deploymentScope": "subscription",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/ActivityLogAlerts/enabled",
                "equals": "[parameters('enabled')]"
              },
              {
                "count": {
                  "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]",
                  "where": {
                    "anyOf": [
                      {
                        "allOf": [
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                            "equals": "category"
                          },
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                            "equals": "Administrative"
                          }
                        ]
                      },
                      {
                        "allOf": [
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                            "equals": "operationName"
                          },
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                            "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write"
                          }
                        ]
                      }
                    ]
                  }
                },
                "equals": 2
              }
            ]
          },
          "deployment": {
            "location": "westeurope",
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "alertResourceGroupName": {
                    "type": "string",
                    "defaultValue": "rg-amba-monitoring-001"
                  },
                  "enabled": {
                    "type": "string",
                    "defaultValue": "true"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Resources/resourceGroups",
                    "apiVersion": "2021-04-01",
                    "location": "westeurope",
                    "name": "[parameters('alertResourceGroupName')]"
                  },
                  {
                    "type": "Microsoft.Resources/deployments",
                    "apiVersion": "2019-10-01",
                    "name": "AlertVNETPeering",
                    "resourceGroup": "[parameters('alertResourceGroupName')]",
                    "dependsOn": [
                      "[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]"
                    ],
                    "properties": {
                      "mode": "Incremental",
                      "template": {
                        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                        "contentVersion": "1.0.0.0",
                        "parameters": {
                          "enabled": {
                            "type": "string",
                            "defaultValue": "true"
                          },
                          "alertResourceGroupName": {
                            "type": "string",
                            "defaultValue": "rg-amba-monitoring-001"
                          }
                        },
                        "variables": {},
                        "resources": [
                          {
                            "type": "microsoft.insights/activityLogAlerts",
                            "apiVersion": "2020-10-01",
                            "name": "ActivityVNETPeeringCreateUpdate",
                            "location": "global",
                            "properties": {
                              "description": "Activity Log VNET Peering Create or Update",
                              "enabled": "[parameters('enabled')]",
                              "scopes": [
                                "[subscription().id]"
                              ],
                              "condition": {
                                "allOf": [
                                  {
                                    "field": "category",
                                    "equals": "Administrative"
                                  },
                                  {
                                    "field": "operationName",
                                    "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write"
                                  },
                                  {
                                    "field": "status",
                                    "containsAny": [
                                      "succeeded"
                                    ]
                                  }
                                ]
                              },
                              "actions": {
                                "actionGroups": [
                                  {
                                    "actionGroupId": "/subscriptions/XXXxxx/resourcegroups/RGGROUPZZZ/providers/microsoft.insights/actiongroups/ag_vnetpeeringalert",
                                    "webhookProperties": {}
                                  }
                                ]
                              }
                            }
                          }
                        ]
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
    },
    "versions": [
      "1.0.0"
    ]
  },
  "id": "/providers/Microsoft.Management/managementGroups/MGID/providers/Microsoft.Authorization/policyDefinitions/POLID",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "c62d80ee-da27-4fbf-be32-ef4086046a22",
  "systemData": {
    "createdBy": "userupn",
    "createdByType": "User",
    "createdAt": "2024-05-14T06:57:27.9570401Z",
    "lastModifiedBy": "userupn",
    "lastModifiedByType": "User",
    "lastModifiedAt": "2024-05-14T12:59:29.9138366Z"
  }
}
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
817 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Monalla-MSFT 12,686 Reputation points
    2024-06-17T18:52:46.7566667+00:00

    @Christophe Humbert - Welcome to Microsoft Q&A and thanks for reaching out to us.

    You need to pass in the policy’s parameter into the template as a value, otherwise it won’t have the context it needs to pull from the policy parameters. It should look something like this in the deployment template:

     

    "parameters": {

        "alertResourceGroupName": {

            "value": "[parameters('alertResourceGroupName')]"

        },

        "enabled": {

            "value": "[parameters('enabled')]"

        }

    },

    "variables": {},

    "resources": [

        {

            "type": "Microsoft.Resources/resourceGroups",

            "apiVersion": "2021-04-01",

            "location": "westeurope",

            "name": "[parameters('alertResourceGroupName')]"

        },

    ...

     

    The type, defaultValue, etc. should be inherited from the policy parameter.

    Note: the parameter names on the highlighted lines should match what’s defined in the policy definition parameters. They do not need to match the names of the deployment template parameter names. They just happen to be in this example.

     

    Nested parameters are described in our docs here:

    Azure Policy definitions deployIfNotExists effect - Azure Policy | Microsoft Learn

    Hope this helps. and please feel free to reach out if you have any further questions.

    Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.

    0 comments