How to identify Azure Data Lake Gen 2 inside Azure Policy

Question

Hello

I need to scope an Azure Policy on Azure Data Lake Gen2 to prevent http and disabling secure transfer

Thanks in advance

Answer 1

Hi
Christophe Humbert

Sure let me help you on this, first open your Azure portal, go to the "Policy" service.

Click on "Definitions" then Click on "+ Policy definition."

Provide a name and description and category for your policy.

In the "Policy rule" section, use the below JSON policy definition

{
   "mode": "All",
   "policyRule": {
      "if": {
         "allOf": [
            {
               "field": "type",
               "equals": "Microsoft.Storage/storageAccounts"
            },
            {
               "not": {
                  "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
                  "equals": true
               }
            }
         ]
      },
      "then": {
         "effect": "deny"
      }
   }
}

The abovepolicy denies the creation or modification of storage accounts that do not have (HTTPS) enabled.

finally in the "Policy" service, click on "Assignments" Click on "+ Assign policy.

Choose the policy definition you created earlier.

Set the "Parameters" as needed (if your policy has any).

Configure "Assignment name" and "Assignment description."

Click "Review + create" and then "Create" to assign the policy.

If this helps kindly accept the answer thanks much.

Answer 2

Hello @Christophe Humbert

Azure Data Lake Storage Gen2 is a set of capabilities dedicated to big data analytics, built on Azure Blob Storage. It’s not a dedicated service or account type. Therefore, to identify Azure Data Lake Gen2 inside Azure Policy, you need to look for Azure Storage accounts with the hierarchical namespace enabled.

To scope an Azure Policy on Azure Data Lake Gen2 to prevent HTTP and disabling secure transfer, you can create a custom policy definition that targets Azure Storage accounts with the hierarchical namespace enabled. The policy should enforce the use of HTTPS and enable secure transfer.

Here’s a high-level overview of the steps:

Identify Azure Data Lake Gen2: Use the Get-AzStorageAccount command with the EnableHierarchicalNamespace property to identify if Data Lake Gen2 is enabled.

Create a Custom Policy Definition: Create a custom policy definition in Azure Policy that targets Azure Storage accounts. The policy definition should include conditions to check if the hierarchical namespace is enabled (which indicates it’s a Data Lake Gen2 account).

Enforce HTTPS and Secure Transfer: In the policy definition, include effects to enforce the use of HTTPS and enable secure transfer. This can be done by setting the supportsHttpsTrafficOnly property to true.

Assign the Policy: Once the policy definition is created, assign it to the scope where your Data Lake Gen2 accounts are located.

** Important: Note that this is a high-level overview, so, the exact steps can vary based on your specific requirements and Azure environment.

Wishing you well,

@shirivo