azure policy to check managedby property of resource group

Question

hi,

i m trying to create azure policy to make sure the mangedby property is set when creating resources group using terraform.

{ "field": "type", "equals": "Microsoft.Resources/resourceGroups/managedBy" }

but this property does not have an alias to use it in policy.

is there any way i can make this policy work

Answer 1

{
  "properties": {
    "displayName": "Enforce managedBy property for resource groups",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {},
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Resources/resourceGroups"
      },
      "then": {
        "effect": "audit",
        "details": {
          "type": "Microsoft.Resources/resourceGroups/managedBy"
        }
      }
    }
  }
}

Answer 2

Unfortunately, Azure policy cannot be applied to check managedby property of resource group.

ManagedBy property is a top-level property and is not currently supported.  Policy aliases for top-level properties are not generated.

You can use Powershell/CLI or REST API to GET and audit this property of RG though.