How to enforce IaC in production? are there some references of custom policies that accepts only deployments made by service principles?

Question

How to enforce IaC in production? are there some references of custom policies that accepts only deployments made by service principles?

SrVish 20

I am learning about enforcing IaC in our cloud environments and I am looking for some best practices and references on this.

Accepted answer

0 additional answers

Your answer

Answer 1

Stanislav Zhelyazkov 28,426 MVP Volunteer Moderator

Hi,

Enforcing deployments only by service principals it is not possible. The only way to semi-achieve this is by giving appropriate permissions to deploy/create resources to service principals only and for all other accounts to give only reader permissions. In case some actions needs to be done by users you can use Entra PIM to allow access temporary. That is usually a standard practice. If you want to limit the access to resources deployed by IaC I would suggest to look at Azure Bicep and deployment stacks. Deployment stacks allows for locking the resources so they cannot be modified outside of the deployment stacks deployment. Alternatively you can look at Azure Policy deny action as a way to protect resources.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Srinivasa Reddy Jaggavarapu 1,560 Reputation points Microsoft External Staff Moderator

2025-04-04T06:41:23.1366667+00:00

Hi SrVish,

Just checking in to see if the below answer provided by @Stanislav Zhelyazkov helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
SrVish 20 Reputation points

2025-04-04T08:06:57.24+00:00
Hi Stanislav Zhelyazkov,
Thanks for the insights — really helpful context!

We're looking to enforce Infrastructure as Code using Terraform specifically, so we're not planning to use Bicep or deployment stacks at this point. Our goal is to ensure that all infrastructure changes are rolled out through Terraform pipelines using service principals, and that manual changes via portal/CLI are either prevented or at least flagged.

Given that, I had a couple of follow-up questions:

Are there any best practices or patterns you've seen for enforcing Terraform-only deployments in Azure, especially around access control and policy?

Is it feasible to use Azure Policy to restrict changes to only those initiated by specific service principals (like the one used in CI/CD)?
Stanislav Zhelyazkov 28,426 Reputation points MVP Volunteer Moderator

2025-04-04T09:20:29.1+00:00

ok I understand. Unfortunately deployment stacks is not possible via Terraform which could fit for your requirements. In the case of Azure policy you will be able to restrict only delete actions as policy exemptions/exclusions currently can only apply to specific resources not to specific SP, group or user. Your best option is to use PIM to restrict to minimum permissions (reader and may be some other actions like start, stop, etc.) the users by default and with ability to elevate access upon request. Of course PIM requires Entra licenses which is additional cost if you do not have it. You can achieve the same functionality available by PIM by adding/removing role assignments on your own via your CI/CD pipelines but of course that will be manual process and who is able to deploy those pipelines will depend on the security of your CI/CD.

Share via

How to enforce IaC in production? are there some references of custom policies that accepts only deployments made by service principles?

0 additional answers

Your answer