Creating a policy for Vnet DNS setting in correct order

Question

I am looking into making a policy that depending on the region it sets the vnet dns setting in a specific order to try the closer ones first. I found the policy in the link but it does not check the order of the server (https://stackoverflow.com/questions/56523274/azure-deployifnotexist-policy-evalutes-but-do-not-deploy-template-show-compliant). I was wondering if I can reference the specific server in the dhcp array like below?

"field" : "Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[1]",
							"value" : "1.1.1.1"

Answer 1

Got it to work and I am posting for the next person that needs it.

    "parameters": {
      "listOfWestLocations": {
        "type": "Array",
        "metadata": {
          "displayName": "listOfWestLocations",
          "description": "Location that will have the West DNS Settings"
        },
        "defaultValue": [
          "westus",
          "westus1",
          "westus2",
          "westcentralus"
        ]
      },
      "listOfEastLocations": {
        "type": "Array",
        "metadata": {
          "displayName": "listOfEastLocations",
          "description": "Location that will have the West DNS Settings"
        },
        "defaultValue": [
          "eastus",
          "eastus1",
          "eastus3",
          "centralus",
          "northcentralus",
          "southcentralus"
        ]
      }
    },
    "policyRule": {
      "if": {
        "allof": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks"
          },
          {
            "allof": [
              {
                "anyOf": [
                  {
                    "value": "8.8.8.8",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),1)]"
                  },
                  {
                    "value": "8.8.4.4",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),2)]"
                  },
                  {
                    "value": "76.76.2.0",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),3)]"
                  },
                  {
                    "field": "location",
                    "notIn": "[parameters('listOfWestLocations')]"
                  }
                ]
              },
              {
                "anyOf": [
                  {
                    "value": "76.76.2.0",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),1)]"
                  },
                  {
                    "value": "8.8.4.4",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),2)]"
                  },
                  {
                    "value": "8.8.8.8",
                    "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),3)]"
                  },
                  {
                    "field": "location",
                    "notIn": "[parameters('listOfEastLocations')]"
                  }
                ]
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "audit"
      }
    }
  },

Answer 2

@Kevin Pirko , Thank you for posting this question.

The Azure policy definition does not support array indexing. If you try to use indexing with Array type parameter/field, the following error is obtained for

Supported aliases are

Based on my understanding, you are trying to ensure a particular order of "IP Addresses" specified for custom DNS Servers on a VNET based on its location. This was an interesting scenario.

I tried it in my test subscription and found that a combination of field() and take() methods can help you determine the order. Take() returns an array with specified number of elements from the start of the array. Hence, we can use "notIn" condition of policy evaluation.

Here is a sample policy which checks if the VNets have IPs in particular order:

{
  "properties": {
    "displayName": "Custom - Order of DNS to be fixed",
    "policyType": "Custom",
    "mode": "Indexed",    
    "parameters": {},
    "policyRule": {
      "if": {
  "allof": [                 //<--updated 08/30
     {       
      "field": "type",
      "equals": "Microsoft.Network/virtualNetworks"
    },
    {
      "anyOf": [             //<-- anyOf to check if "any of" the condition is unmet, return true
        {
          "value": "8.8.8.8",
          "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),1)]"
        },
        {
          "value": "8.8.4.4",
          "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),2)]"
        },
        {
          "value": "76.76.2.0",
          "notIn": "[take(field('Microsoft.Network/virtualNetworks/dhcpOptions.dnsServers[*]'),3)]"
        }
      ]
    }
  ]
},
      "then": {
        "effect": "audit"
      }
    }
  }

This policy put all the VNETs in to non-compliant state except for the VNET which had the following configuration:

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.