Modifying Azure policy to add exclusion based on specific Resource Group name?

Question

Modifying Azure policy to add exclusion based on specific Resource Group name?

EnterpriseArchitect 6,041

I need some help in modifying the Azure Policy definition to include the below lines:

{  
  "allOf": [  
    {  
      "field": "type",  
      "equals": "Microsoft.Resources/subscriptions/resourceGroups"  
    },  
    {  
      "field": "[concat('tags[', parameters('tagName'), ']')]",  
      "exists": "false"  
    },  
    {  
      "anyOf": [  
        {  
          "value": "[startsWith(field('name'), 'MC_')]",  
          "notEquals": "true"  
        }  
      ]  
    }  
  ]  
}

This is my existing Azure policy definition with allOf:

  "policyRule": {  
    "if": {  
      "allOf": [  
        {  
          "field": "type",  
          "equals": "Microsoft.Network/virtualNetworks"  
        },  
        {  
          "field": "Microsoft.Network/virtualNetworks/addressSpace.addressPrefixes[*]",  
          "notContains": "11.22.33"  
        }  
      ]  
    },  
    "then": {  
      "effect": "deny"  
    }  
  }

and another one with anyOf

    "policyRule": {  
      "if": {  
        "anyOf": [  
          {  
            "not": {  
              "field": "[concat('tags[', parameters('tagnameteam'), ']')]",  
              "in": "[parameters('listofallowedtagvalues')]"  
            }  
          }  
        ]  
      },  
      "then": {  
        "effect": "Deny"  
      }  
    }  
  }

How can I achieve it by modifying the existing Azure policy definition?

Thank you.

Accepted answer

0 additional answers

Your answer

Answer 1

I had a go at this but haven't tested.

Note: removed the condition referencing "Microsoft.Resources/subscriptions/resourceGroups" because the existing definition already references "Microsoft.Network/virtualNetworks" and policy validation complains if you have conditions for more than 1 resources type specified in the same definition.

Question: are tag values also required for the exclusion, not just the RG name?

{  
    "mode": "All",  
    "parameters": {  
        "tagName": {  
            "type": "String",  
            "metadata": {  
                "displayName": "Tag name",  
                "description": "Name of the tag"  
            }  
        }  
    },  
    "policyRule": {  
        "if": {  
            "allOf": [  
                {  
                    "field": "type",  
                    "equals": "Microsoft.Network/virtualNetworks"  
                },  
                {  
                    "field": "Microsoft.Network/virtualNetworks/addressSpace.addressPrefixes[*]",  
                    "notContains": "11.22.33"  
                },  
                {  
                    "allOf": [  
                        {  
                            "field": "[concat('tags[', parameters('tagName'), ']')]",  
                            "exists": "false"  
                        },  
                        {  
                            "value": "[startsWith(field('name'), 'MC_')]",  
                            "notEquals": "true"  
                        }  
                    ]  
                }  
            ]  
        },  
        "then": {  
            "effect": "deny"  
        }  
    }  
}

EnterpriseArchitect 6,041 Reputation points

2022-11-26T06:11:16.94+00:00

Question: are tag values also required for the exclusion, not just the RG name?

Yeah, the tag values must be exempted since the managed container deploys the Resource group automatically as well.

There are Azure policies restricting Resource Groip deployment without some required Tags.
Jesse Loudon 336 Reputation points

2023-03-03T03:49:38.39+00:00

Ok great, have you been able to test my above JSON snippet or have I completely missed something. Thanks

Share via

Modifying Azure policy to add exclusion based on specific Resource Group name?

0 additional answers

Your answer