Is there a way to exclude resource groups that contain the word databricks from policy assignment ?

Question

Hi - We have a number of policies that check if diagnostic settings are created for resources. Since databricks uses a managed resource group, these policies always show non-compliant.
Is there a way i could use a '*' in the policy definition to exclude the resources groups that have databricks in the name ? This will help me a lot.

Answer 1

Hi,
My advice is to use exclusions via the policy assignments or create exemptions. If you want the policy to exclude these from appearing in compliance results that will require cloning all these policy definitions where you want to do that, modify the rule within the definition and save them as new policy definitions and use those new policy definitions when you create policy assignments. Having custom definitions is something normal but for your case this is something that should be done via exclusions or exemptions rather modifying the rule.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi - I ended up using a wildcard in the policy definition and it worked quite well.

policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/networkInterfaces"
},
{
"not": {
"value": "[resourceGroup().name]",
"like": "databricks-rg*"
}
}
]
}

Answer 3

Stan - Thanks for the response.
Ok so i can use exclusions via policy assignments but i will still need to use a wildcard as the databricks managed RG names we have are like this:
databricks-rg-xyzocessing-knprpqpjhrrww
databricks-rg-xyzprocessing01-p43vspm6u6sos

Is there are way to use a wildcard to exclude RGs that begin with databricks ?

Answer 4

Understood. It would have helped if the databricks resource groups had some kind of msft generated tag like 'databricks-managed-rg" so we could probably do :

{
"not": {
"field": "tags[databricks-managed-rg]",
"exists": "true"
}
}

Answer 5

Thank you Stan.
I am thinking of a different approach:
It seems that when a tag type="databricks" is applied to a databricks resource, it get applied automatically to the managed resource group.

on that basis, i am creating a modify policy to apply that tag to any databricks resources at the management group level and remediate existing resources
Once the tags are applied, i should be able to exclude databricks RGs based on that tag.

Sounds feasible ?