How Can I create deny policy for AKS Clusters creation if the subscription doesn't have a specific tag of "AKS-Enabled"? Every way I try it complains of multiple resources.

Question

Below is my code for Deny:

{
    "mode": "All",
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions"
          },
          {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "notEquals": "[parameters('tagValue')]"
          },
          {
            "field": "type",
            "equals": "Microsoft.ContainerService/managedClusters"
          }
        ]
      },
      "then": {
        "effect": "deny"
        }
      },
    "parameters": {
      "tagName": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Name",
          "description": "Name of the tag, such as 'environment'"
        },
        "defaultValue": "AKS-Enabled"
      },
      "tagValue": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Value",
          "description": "Value of the tag, such as 'production'"
        },
        "defaultValue": "true"
      }
    }
  }

Answer 1

This creates a policy but doesn't do the needful

Answer 2

Hello @Kalra, sakshi

can you try an example of a custom policy definition in JSON format that blocks AKS Clusters creation if the subscription is not compliant with your organization's policies:

{
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.ContainerService/managedClusters"
            },
            {
                "not": {
                    "field": "Microsoft.ContainerService/managedClusters/subscriptionId",
                    "in": "[parameters('allowedSubscriptionIds')]"
                }
            }
        ]
    },
    "then": {
        "effect": "deny"
    }
}
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.ContainerService/managedClusters"
            },
            {
                "not": {
                    "field": "Microsoft.ContainerService/managedClusters/subscriptionId",
                    "in": "[parameters('allowedSubscriptionIds')]"
                }
            }
        ]
    },
    "then": {
        "effect": "deny"
    }
}

This policy definition checks if the subscription ID of the AKS cluster is in the allowedSubscriptionIds parameter. If it is not, the policy denies the creation of the AKS cluster.

Please note that this is just an example, and you should customize the policy definition to fit your organization's policies.

https://learn.microsoft.com/en-us/azure/aks/use-azure-policy

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Answer 3

@Anonymous

Please remove the below section and try creating it - it should go through!

{
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions"
          },

I just tried your same policy file , it was failing with below error:

Once I removed the section , it got created successfully:

{
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions"
          },