Question 192588 in Azure Question posted in
The official documentation to get you started can be found here.

How to block a creation of new public ips in azure

I am trying to stop users that arent global admins from creating new public ips and assigning them to vms or nics. But I dont want to affect the existing assigned ips.
I think the best way to do it is with a policy.

I found this policy that block public ips in all resource groups that arent specified but I dont know if it will affect the existing ones

"policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/networkInterfaces"
          },
          {
            "field": "Microsoft.Network/networkInterfaces/ipconfigurations[*].publicIpAddress.id",
            "exists": true
          },
          {
            "value": "[resourceGroup().name]",
            "notEquals": "resource-group-name"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }

Someone know if it will affect the existing or know a better way to write a policy that can help me

Tags:

2

Answers


  1. 0

    The policy you mentioned will block Public IPs in all resource groups that are not specified in Policy, but it will not affect the existing ones.

    However, it will block the creation of new public IPs and the assignment to Network resources in the resource groups that are not specified. If you want to block the creation of new public IPs but allow the assignment of existing Public IP, you can use the below policy.

        {
      "mode": "All",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Network/publicIPAddresses"
            },
            {
              "field": "Microsoft.Network/publicIPAddresses/ipConfiguration.id",
              "exists": false
            },
            {
              "value": "[resourceGroup().name]",
              "notEquals": "v-venkat-mindtree"
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      },
      "parameters": {}
    }

    Output:

    Public IP creation with other Resource Group

    enter image description here

    Public IP creation with specified Resource Group

    enter image description here

    Successfully assigned existing Public IP to Network Interface.

    enter image description here

    Login or Signup to reply.
  2. 0

    Azure Policy will evaluate and report back all resources that are in violation of the policy; however, unless it is attached with a Deploy If Not Exists No actions will be taken.

    The Azure Policy will execute against a deployment once one is submitted. To be clear this will include any update to an existing resource or any net new resource creation. When the deployment is submitted, in this case, the deny action will occur and block the deployment. Policy can also be used to with different actions.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search