How to block a creation of new public ips in azure
I am trying to stop users that arent global admins from creating new public ips and assigning them to vms or nics. But I dont want to affect the existing assigned ips. I think the best way to do it…
How can Azure Lifecycle Mgmt Policy be applied to recurring file names?
How does one go about applying an Azure Lifecycle Management Policy to a file name that appears(duplicated name, different file contents) in different blob directories while avoiding effecting other blobs? The file name in question is executionlogs.txt here is how…
How can I set up multiple working dirs for CI/CD on Ubuntu?
I'm trying to run below YAML file with a job. How can I specify working directory, if I want this to trigger when there is change in any child folders? For example: below is the snippet of my working directory…
How can I check if azure stoarge account has a tag with name that starts with "ABC"
I am trying to create a azure policy that blocks resources from having tag that start's with "ABC". POLICY "parameter" :{ "tagname":{ "type":"string", "defaultValue":"ABC" } }, "policyRule" :{ "if" : { "allOf" : [ { "field":"type", "equals":"Microsoft.Storage/storageAccounts" }, { "field":"[concat('tags[',…
Azure – Checking that old and new ressources are configured with a tag with specific case
Hello community 🙋♂️! I'm configuring an Azure Policy to check presence of a tag on new and old ressources. Checking the presence only was quite easy: policy_rule = <<RULE { "if": { "allOf": [ { "field": "type", "equals": "Microsoft.Resources/subscriptions/resourceGroups" },…
Is it possible to create an Azure Policy Exemption at the same as as the resource being exempted?
Azure Policy can be used to define conventions that, when Policy Enforcement is enabled, will prevent non-compliant resources from being created. In scenarios where non-compliant resources need to be exempted this leads to having to coordinate several steps: Disable policy…
Azure policy fails to deploy a policy assignment with deployIfNotExists
I have a resource whitelist policy defined as follows: { "properties": { "displayName": "Deny resource creation if not in whitelist", "policyType": "Custom", "mode": "Indexed", "description": "This policy denies the creation resources which are not allowed in the whitelist.", "policyRule": {…
How to customize Subscription contributor role for blocking Storage in Azure
I have a requirement to customize the contributor role at Azure Subscription level, such that, people added to that customized contributor role can NOT view or read the data from the storage account (under that subscription). This is how i'm…
Why doesn't Azure Policy apply to Delete operations?
Azure Resource Policy advertises itself as: Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill…
Azure – prevent Subscription Owner from modifying specific Resource Group?
I'm exploring options for securing some Azure resources within a subscription from tampering, even by subscription owners. The intent is to standardize our subscriptions which are used by other teams for their engineering. We've considered giving teams custom RBAC roles…