Deny deletion using Azure policy

Question

Say we have a private dns zone called privatezone.com and it has entries such as

A test1                      10.2.2.0  
A test2                      10.2.2.1  
A critical-resource1  10.2.2.3  
A critical-resource2  10.2.2.4  

Of those records, we want to be able to delete all A records except those which contain the term critical-resource. Can we do this via a policy?
Maybe in the lines of:

{  
    "mode": "All",  
    "policyRule": {  
      "if": {  
        "allOf": [  
          {  
            "field": "type",  
            "equals": "Microsoft.Network/privateDnsZones/A"  
          },  
          {  
            "field": "name",  
            "contains": "critical-resource"  
          },  
          {  
            "field": "name",  
            "exists": false  
          }  
        ]  
      },  
      "then": {  
        "effect": "deny"  
      }  
    },  
    "parameters": {}  
  }  

Thinking if "deny deletion" cannot be done via policies hence we have resource locks, but then how do we deny with such granularity?

Answer 1

Hi @rubberduckdev,

Thank you for reaching out to Microsoft Q&A.

This approach via Azure Policy is not going to work for the scenario mentioned in the question. The deny affect is used to prevent a resource request that doesn't match defined standards through a policy definition and fails the request. A basic example would be that "deny all operation on a resource which does not have a particular tag. This would not not work selectively - to allow modification to one property and deny for other". This affect is not selective and will operate on the entire resource.

For the use case mentioned in the question, "Locks" and "RBAC to follow principle of least privilege" are the best way to proceed forward.
Locks: you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications.
Role based access control (RBAC): To ensure that critical resources are accessible to only those who have the requirement.

Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Answer 2

There is a new effect called denyAction that is currently in public preview and available to all tenants. You can find more information here: https://www.youtube.com/watch?v=SboRUcRZqyc&list=WL&index=5