I’m simply trying to take the default deny template and add a few more tags that I want to get added to the resources. I get an error that says "tagName1" is not allowed. What am I missing?
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Resources/subscriptions/resourceGroups"
},
{
"field": "[concat('tags[', parameters('tagName'),('tagName1') ']')]",
"exists": "false"
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName": {
"type": "String",
"metadata": {
"displayName": "Tag Name",
"description": "Name of the tag, such as 'environment'"
},
"tagName1": {
"type": "String",
"metadata": {
"displayName": "Project",
"description": "Name of the tag, such as 'environment'"
}
},
2
Answers
You’re just missing a closing brace after tagName.
In your policy, Tag names such as tagName and tagName1, must be separately defined within the parameters object. The concatenated tag names should be used in the field condition of the policy rule to check for their existence.
Here is the updated policy.
Output:
The policy is denying the resource group with different tag names.