How to create a custom policy for secrets in keyvault

Question

hi,

I found an article "Azure Policy for Key Vault now supports keys, secrets, and certificates"

[https://azure.microsoft.com/en-au/updates/keyvaultpolicy/

I'm trying to create a policy that prevent users from adding secret if they don't add a specific tag.

I want the tag to be connected to a certain resource that that secret is for.

so far I have:

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "not": {
        "field": "tags[myResource]",
        "in": [
          "proj1",
          "proj2",
          "proj3"
          "proj4"
        ]
      }
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

but even that is not preventing the creation of the secret

also, when trying to use:

"mode": "Microsoft.KeyVault.Data"

the creation of the policy throws an exception

The policy definition '' rule is invalid. The provider 'Microsoft.KeyVault.Data' referenced by the 'field' property 'Microsoft.KeyVault.Data/vaults/secrets' of the policy rule doesn't exist.

thanks in advance

Answer 1

Currently the provider 'Microsoft.KeyVault.Data' only supports built-in policies provided by Microsoft so if you try and create a custom policy using this provider it will be denied. I tested myself today and received this portal error:

There's a statement on Microsoft Docs relating to RPs and supported definitions below:

Unless explicitly stated, Resource Provider modes only support built-in policy definitions, and exemptions are not supported at the component-level.

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#resource-provider-modes