Azure Policy Deployifnotexist Nested Templates and Parameters

Question

Hello,

I have a policy to deploy an alert on all subs not having it (as you can not create alert with MG group scope for now)...And I was not able to have parameters bein taken into account from the Policy down to the two nested templates for the deployment...I had to repeat the default value to have the remediation task not failing (i.e. the deployement).

Any hints would be nice

{
  "properties": {
    "displayName": "Alert for VNET Peering",
    "policyType": "Custom",
    "mode": "All",
    "metadata": {
      "category": "Monitoring",
      "createdBy": "USERID",
      "createdOn": "2024-05-07T08:32:23.1194688Z",
      "updatedBy": null,
      "updatedOn": null
    },
    "version": "1.0.0",
    "parameters": {
      "enabled": {
        "type": "String",
        "metadata": {
          "displayName": "Alert State",
          "description": "Alert state for the alert"
        },
        "allowedValues": [
          "true",
          "false"
        ],
        "defaultValue": "true"
      },
      "alertResourceGroupName": {
        "type": "String",
        "metadata": {
          "displayName": "Resource Group Name",
          "description": "Resource group the alert is placed in"
        },
        "defaultValue": "rg-amba-monitoring-001"
      },
      "MonitorDisable": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled"
        },
        "defaultValue": "MonitorDisable"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks/"
          },
          {
            "field": "[concat('tags[', parameters('MonitorDisable'), ']')]",
            "notEquals": "true"
          }
        ]
      },
  
"then": {
        "effect": "deployIfNotExists",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "type": "Microsoft.Insights/activityLogAlerts",
          "name": "AlertVNETPeering",
          "existenceScope": "resourceGroup",
          "resourceGroupName": "[parameters('alertResourceGroupName')]",
          "deploymentScope": "subscription",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/ActivityLogAlerts/enabled",
                "equals": "[parameters('enabled')]"
              },
              {
                "count": {
                  "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]",
                  "where": {
                    "anyOf": [
                      {
                        "allOf": [
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                            "equals": "category"
                          },
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                            "equals": "Administrative"
                          }
                        ]
                      },
                      {
                        "allOf": [
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                            "equals": "operationName"
                          },
                          {
                            "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                            "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write"
                          }
                        ]
                      }
                    ]
                  }
                },
                "equals": 2
              }
            ]
          },
          "deployment": {
            "location": "westeurope",
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "alertResourceGroupName": {
                    "type": "string",
                    "defaultValue": "rg-amba-monitoring-001"
                  },
                  "enabled": {
                    "type": "string",
                    "defaultValue": "true"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Resources/resourceGroups",
                    "apiVersion": "2021-04-01",
                    "location": "westeurope",
                    "name": "[parameters('alertResourceGroupName')]"
                  },
                  {
                    "type": "Microsoft.Resources/deployments",
                    "apiVersion": "2019-10-01",
                    "name": "AlertVNETPeering",
                    "resourceGroup": "[parameters('alertResourceGroupName')]",
                    "dependsOn": [
                      "[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]"
                    ],
                    "properties": {
                      "mode": "Incremental",
                      "template": {
                        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                        "contentVersion": "1.0.0.0",
                        "parameters": {
                          "enabled": {
                            "type": "string",
                            "defaultValue": "true"
                          },
                          "alertResourceGroupName": {
                            "type": "string",
                            "defaultValue": "rg-amba-monitoring-001"
                          }
                        },
                        "variables": {},
                        "resources": [
                          {
                            "type": "microsoft.insights/activityLogAlerts",
                            "apiVersion": "2020-10-01",
                            "name": "ActivityVNETPeeringCreateUpdate",
                            "location": "global",
                            "properties": {
                              "description": "Activity Log VNET Peering Create or Update",
                              "enabled": "[parameters('enabled')]",
                              "scopes": [
                                "[subscription().id]"
                              ],
                              "condition": {
                                "allOf": [
                                  {
                                    "field": "category",
                                    "equals": "Administrative"
                                  },
                                  {
                                    "field": "operationName",
                                    "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write"
                                  },
                                  {
                                    "field": "status",
                                    "containsAny": [
                                      "succeeded"
                                    ]
                                  }
                                ]
                              },
                              "actions": {
                                "actionGroups": [
                                  {
                                    "actionGroupId": "/subscriptions/XXXxxx/resourcegroups/RGGROUPZZZ/providers/microsoft.insights/actiongroups/ag_vnetpeeringalert",
                                    "webhookProperties": {}
                                  }
                                ]
                              }
                            }
                          }
                        ]
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
    },
    "versions": [
      "1.0.0"
    ]
  },
  "id": "/providers/Microsoft.Management/managementGroups/MGID/providers/Microsoft.Authorization/policyDefinitions/POLID",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "c62d80ee-da27-4fbf-be32-ef4086046a22",
  "systemData": {
    "createdBy": "userupn",
    "createdByType": "User",
    "createdAt": "2024-05-14T06:57:27.9570401Z",
    "lastModifiedBy": "userupn",
    "lastModifiedByType": "User",
    "lastModifiedAt": "2024-05-14T12:59:29.9138366Z"
  }
}

Answer 1

@Christophe Humbert - Welcome to Microsoft Q&A and thanks for reaching out to us.

You need to pass in the policy’s parameter into the template as a value, otherwise it won’t have the context it needs to pull from the policy parameters. It should look something like this in the deployment template:

 

"parameters": {

    "alertResourceGroupName": {

        "value": "[parameters('alertResourceGroupName')]"

    },

    "enabled": {

        "value": "[parameters('enabled')]"

    }

},

"variables": {},

"resources": [

    {

        "type": "Microsoft.Resources/resourceGroups",

        "apiVersion": "2021-04-01",

        "location": "westeurope",

        "name": "[parameters('alertResourceGroupName')]"

    },

...

 

The type, defaultValue, etc. should be inherited from the policy parameter.

Note: the parameter names on the highlighted lines should match what’s defined in the policy definition parameters. They do not need to match the names of the deployment template parameter names. They just happen to be in this example.

 

Nested parameters are described in our docs here:

Azure Policy definitions deployIfNotExists effect - Azure Policy | Microsoft Learn

Hope this helps. and please feel free to reach out if you have any further questions.

---

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.