How to create a custom policy that shows who create the resources on Azure

Cinthia Rodriguez 50

Hello Everyone,

I would like to get your help regarding to know what could be a json structure to create a Azure policy that will allow me to identify who create the Azure resources on a subscription.

Thank you and help will be very helpfull.

Accepted answer

Marcin Policht 26,235 Reputation points MVP

2024-10-11T20:57:07.51+00:00

You don't need a policy for this. This information is already recorded in the Activity Log. More at https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-insights

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

3 additional answers

Cinthia Rodriguez 50 Reputation points

2024-10-12T02:19:26.33+00:00

Hi , yes I am aware, but I still need a policy as that as customer require to have a Tag that shows , who create the resources on their subscription
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
Cinthia Rodriguez 50 Reputation points

2024-10-15T17:22:40.54+00:00

Hi @rootjohn how can I use the Azure Activity Logs with a policy that will create a tag as "createdby",there is a policy by default that allow to create tag for resources,as explained here https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies but, I need help to know how to configure that policy for example with the Activity logs
Please sign in to rate this answer.
SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-16T21:33:41.38+00:00

@Cinthia Rodriguez Greetings!

First thing, you need to create a custom policy definition that checks for the presence of the "createdBy" tag and assigns it based on the Activity Logs.

Here’s an example of a policy definition that checks for the tag and a parameter to specify the tag name:

{ "mode": "Indexed", "policyRule": { "if": { "allOf": [ { "field": "type", "notEquals": "Microsoft.Resources/subscriptions/resourceGroups" }, { "field": "tags['createdBy']", "exists": "false" } ] }, "then": { "effect": "append", "details": [ { "field": "tags", "value": { "createdBy": "[parameters('createdByValue')]" } } ] } }, "parameters": { "createdByValue": { "type": "String", "metadata": { "displayName": "Created By Value", "description": "Value to assign for the createdBy tag." } } } }

After creating the policy definition, assign it to the desired scope (subscription/resource group) where you want to enforce this policy.

Secondly, you need to capture the "Created By" Information. Azure Policy itself does not directly interact with Activity Logs to dynamically assign tags based on user actions. However, you can capture the "createdBy" information from the Activity Log and use Azure Functions or Logic Apps to automate the tagging process.

Follow the detailed steps below:

Create an Azure Function or Logic App: Set up a function or logic app that triggers on new resource creation events.

Monitor Activity Logs: Use the Azure Event Grid to monitor the Activity Logs for resource creation events. You can filter these events to capture the relevant ones.

Extract User Information: In your function or logic app, extract the "createdBy" information from the event data.

Assign the Tag: Use the Azure SDK or REST API to update the resource with the "createdBy" tag using the extracted information.

Example of Azure Function Logic

Here's a simple outline of what the Azure Function could look like in C#:

[FunctionName("TagResource")] public static async Task<IActionResult> Run( [EventGridTrigger] EventGridEvent eventGridEvent, [Inject] IResourceManagementClient resourceManagementClient) { var resourceId = eventGridEvent.Data["resourceId"].ToString(); var createdBy = eventGridEvent.Data["creator"].ToString(); // Adjust based on the actual field var tags = new Dictionary<string, string> { { "createdBy", createdBy } }; // Update resource tags await resourceManagementClient.Resources.UpdateAsync(resourceId, new ResourceUpdate { Tags = tags }); return new OkResult(); }

Hope this helps!

Cinthia Rodriguez 50 Reputation points

2024-10-16T21:59:23.7633333+00:00

Hello @SadiqhAhmed-MSFT Thank you for your reply,that is really good.

I just have a questions about that, which is regarding this point

Assign the Tag: Use the Azure SDK or REST API to update the resource with the "createdBy" tag using the extracted information.

This will need to be done manually , I guess from time to time, to have all the resources with the tag information, am I right?

Also, I am thinking to do this at the resource group level, just to show who create every resource group on a subscription

SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-17T05:46:26.01+00:00

@Cinthia Rodriguez Regarding question #1: Yes, you are correct that using the Azure SDK or REST API to update resources with a "createdBy" tag will typically need to be automated if you want to keep it current and comprehensive.

et up an Azure Function or Logic App to listen for resource creation events through Azure Event Grid. When a resource is created, the function or logic app can extract the "createdBy" information from the event data and automatically apply the tag to the newly created resource.

Question #2: If you want to apply the "createdBy" tag at the resource group level rather than individually for each resource, you can modify the logic in your Azure Function or Logic App to tag the resource group itself. This way, whenever a new resource is created within that group, it will inherit the tag, and you only need to manage the tag at the resource group level.

Cinthia Rodriguez 50 Reputation points

2024-10-17T17:38:11.19+00:00

Hi @SadiqhAhmed-MSFT ,I will follow the steps that you mentioned and let you know the result,but I think I can use the policy calls as :Add a tag to a resource groups" https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies I just going to duplicate that and remove the Tag Value since for this case will be the person who create the resource group and keep the Tag name as "Createby" and after that create the Function App, is this looks good for you? what do you think?

Cinthia Rodriguez 50 Reputation points

2024-10-17T18:00:41.7666667+00:00

I just tried to run that policy but seems that it is required to have the value added it,please see the screenshot added it, in the other hand I use the mode as All, since MS documentation suggest to use that one for Resources groups and also suggest to use the effect as "Modify", article reference https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-modify

Cinthia Rodriguez 50 Reputation points

2024-10-17T18:26:46.1966667+00:00

I tried to use the effect as "Modify" using the template that you provide me but does now allow me to continue, but I was able to change the mode from "Index" to "All" without not issues and also change the "notEquals" to "Equals" to "Microsoft.Resources/subscriptions/resourceGroups" and works fine too

Cinthia Rodriguez 50 Reputation points

2024-10-17T18:31:18.4333333+00:00

please see the screenshot

Cinthia Rodriguez 50 Reputation points

2024-10-17T18:33:19.0966667+00:00

For this scenario, what do you think, it is necessary to use the Modify as documentation suggest or we can use the append effect, what do yo think?

SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-18T12:06:24.78+00:00

@Cinthia Rodriguez If that works then go ahead with it.

Cinthia Rodriguez 50 Reputation points

2024-10-18T16:13:23.6966667+00:00

Hi @SadiqhAhmed-MSFT adding the code as you share previously for the first time as shows below

Allow me to create the policy, however at the moment that I attempt to assign that, request me to add a value,please see below

It happens the same if I change the mode as "All", keep the effect as "Append" and change from not equals to equals, please see below

Cinthia Rodriguez 50 Reputation points

2024-10-18T16:34:35.61+00:00

Honestly, I do not know if creating a policy without a value, will work since MS documentation mentioned that tag consist of pair of key-value strings,what do you think about it

SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-23T18:16:14.5466667+00:00

@Cinthia Rodriguez Would it be possible for you to reach out to us through Azure technical support channel by raising a support ticket?

Cinthia Rodriguez 50 Reputation points

2024-10-23T21:32:44.66+00:00

Ok, thank you for your help

SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-24T17:29:29.1066667+00:00

@Cinthia Rodriguez Let us know if there are any challenges contacting Azure technical support team.

Cinthia Rodriguez 50 Reputation points

2024-10-24T22:00:19.9933333+00:00

Ok,but I think I am not going to proceed with this

SadiqhAhmed-MSFT 46,461 Reputation points Microsoft Employee

2024-10-25T06:28:51.89+00:00

@Cinthia Rodriguez Okay!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to create a custom policy that shows who create the resources on Azure

3 additional answers

Your answer