Error in container instance name

Question

Can someone guide me to fix this error:

Getting error while creating container instance, error showing : "Resource 'hci-123' was disallowed by policy (code: RequestDisallowedByPolicy)

{"code":"InvalidTemplateDeployment","message":"The template deployment failed because of policy violation. Please see details for more information.","details":[{"code":"RequestDisallowedByPolicy","target":"hci-123","message":"Resource 'hci-123' was disallowed by policy. (Code: RequestDisallowedByPolicy)","additionalInfo":[{"type":"PolicyViolation","info":{"evaluationDetails":{"evaluatedExpressions":[{"result":"False","expressionKind":"Field","expression":"type","path":"type","expressionValue":"Microsoft.ContainerInstance/containerGroups","targetValue":["Microsoft.ApiManagement/service","Microsoft.AlertsManagement/SmartDetectorAlertRules","Microsoft.Cache/Redis","Microsoft.Cdn/profiles","Microsoft.Cdn/profiles/endpoints","Microsoft.CognitiveServices/accounts","Microsoft.ContainerRegistry/registries","Microsoft.ContainerRegistry/registries/webhooks","Microsoft.DBforMySQL/flexibleServers","Microsoft.DBforPostgreSQL/servers","Microsoft.DBforPostgreSQL/serversv2","Microsoft.DocumentDB/databaseAccounts","microsoft.insights/actiongroups","microsoft.insights/components","microsoft.insights/metricAlerts","Microsoft.insights/workbooks","Microsoft.KeyVault/vaults","Microsoft.Logic/workflows","Microsoft.MixedReality/remoteRenderingAccounts","Microsoft.Network/connections","Microsoft.Network/localNetworkGateways","Microsoft.Network/networkSecurityGroups","Microsoft.Network/publicIPAddresses","Microsoft.Network/trafficmanagerprofiles","Microsoft.Network/virtualNetworkGateways","Microsoft.Network/virtualNetworks","Microsoft.OperationalInsights/workspaces","Microsoft.Portal/dashboards","Microsoft.Relay/namespaces","Microsoft.Resources/resourceGroups","Microsoft.Search/searchServices","Microsoft.Security/automations","Microsoft.ServiceBus/namespaces","Microsoft.ServiceBus/namespaces/authorizationrules","Microsoft.ServiceBus/namespaces/queues","Microsoft.ServiceBus/namespaces/queues/authorizationrules","Microsoft.ServiceBus/namespaces/topics","Microsoft.ServiceBus/namespaces/topics/authorizationrules","Microsoft.ServiceBus/namespaces/topics/subscriptions","Microsoft.ServiceBus/namespaces/topics/subscriptions/rules","Microsoft.SignalRService/SignalR","Microsoft.SignalRService/WebPubSub","Microsoft.Sql/servers","Microsoft.Sql/servers/databases","Microsoft.Storage/storageAccounts","Microsoft.Web/certificates","Microsoft.Web/connections","Microsoft.Web/customApis","Microsoft.Web/serverFarms","Microsoft.Web/serverfarms/workers","Microsoft.Web/sites","Microsoft.Web/sites/instances","Microsoft.Web/sites/metricdefinitions","Microsoft.Web/sites/metrics","Microsoft.Web/sites/slots","Microsoft.Web/sites/slots/instances","Microsoft.Web/sites/slots/metricdefinitions","Microsoft.Web/sites/slots/metrics","Microsoft.Web/staticSites"],"operator":"In"}]},"policyDefinitionId":"/providers/Microsoft.Authorization/policyDefinitions/a08ec900-254a-4555-9bf5-e42af04b5c5c","policySetDefinitionId":"/providers/Microsoft.Management/managementGroups/learn-sandbox-prod/providers/Microsoft.Authorization/policySetDefinitions/webapps-initiative","policyDefinitionReferenceId":"allowed-resource-types_1","policySetDefinitionName":"webapps-initiative","policySetDefinitionDisplayName":"webapps-initiative","policyDefinitionName":"a08ec900-254a-4555-9bf5-e42af04b5c5c","policyDefinitionDisplayName":"Allowed resource types","policyDefinitionEffect":"deny","policyAssignmentId":"/providers/Microsoft.Management/managementGroups/192fe359-e72a-fa7e-dcd5-95e985e7eac9/providers/Microsoft.Authorization/policyAssignments/webapps-assignment","policyAssignmentName":"webapps-assignment","policyAssignmentScope":"/providers/Microsoft.Management/managementGroups/192fe359-e72a-fa7e-dcd5-95e985e7eac9","policyAssignmentParameters":{},"policyExemptionIds":[]}}],"policyDetails":[{"isInitiative":true,"assignmentId":"/providers/Microsoft.Management/managementGroups/192fe359-e72a-fa7e-dcd5-95e985e7eac9/providers/Microsoft.Authorization/policyAssignments/webapps-assignment","assignmentName":"webapps-assignment","auxDefinitions":[{"definitionName":"Allowed resource types","nonComplianceMessage":null}],"viewDetailsUri":"https://portal.azure.com#blade/Microsoft_Azure_Policy/EditAssignmentBladeV2/assignmentId/%2Fproviders%2FMicrosoft.Management%2FmanagementGroups%2F192fe359-e72a-fa7e-dcd5-95e985e7eac9%2Fproviders%2FMicrosoft.Authorization%2FpolicyAssignments%2Fwebapps-assignment"}]}]}

Answer 1

@Jitendra Srivastava

In your subscription there is a policy assigned with name:

/providers/Microsoft.Management/managementGroups/192fe359-e72a-fa7e-dcd5-95e985e7eac9/providers/Microsoft.Authorization/policyAssignments/webapps-assignment

That policy is not allowing you to create the container instance.

Mitigation options would be:-

1. Edit the policy to add Microsoft.ContainerInstance/containerGroups in your allowed list of target values in that particular policy.

(OR)

1. In the same policy there is a parameter to specify Exemptions - you can add that so that the policy will not block you in the creation !

/////////////////////

More details from your error message , how to identify your Microsoft.ContainerInstance/ContainerGroups is allowed or not.

If you see the above error message , search for the targetValue - that is an array which will list out what are all allowed resource types - In that array Microsoft.ContainerInstance/containerGroups value is not listed !!

Regards,

Shiva.