Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Q2 FY25 Policy Refresh #957

Open
wants to merge 37 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
366080e
Update update-policy.yml
oZakari Feb 13, 2025
7ffa11f
feat: Update Policy Library (automated)
actions-user Feb 13, 2025
ee0897e
Remove overpriviledged role scope
oZakari Feb 13, 2025
6444668
Merge branch 'main' into patch-policy-library
oZakari Feb 13, 2025
c7f610f
Update policy definitions and policy set definition variables
oZakari Feb 13, 2025
34b075e
Add policy/definition version
oZakari Feb 13, 2025
bbf87e3
Replace example of old policy definition
oZakari Feb 13, 2025
dfcc8df
feat: Update Policy Library (automated)
actions-user Feb 14, 2025
e1966f6
Shorten module, variable, and parameter descriptions
oZakari Feb 17, 2025
ad81c0d
Correct policy assignment version numbers
oZakari Feb 17, 2025
7bb30cc
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
oZakari Feb 17, 2025
ce8f928
Revert param name for dns zones
oZakari Feb 17, 2025
18b2372
Generate Parameter Markdowns [oZakari/72207811]
github-actions[bot] Feb 17, 2025
c35da08
feat: Update Policy Library (automated)
actions-user Feb 17, 2025
ecae711
Fix invalid effect values for
oZakari Feb 18, 2025
f7f6786
feat: Update Policy Library (automated)
actions-user Feb 19, 2025
3ef4799
Update API version
oZakari Feb 19, 2025
5e1d6ec
Remove old CMK policy set def
oZakari Feb 19, 2025
bfb56a1
feat: Update Policy Library (automated)
actions-user Feb 19, 2025
22e818f
Add definition version for policy set def
oZakari Feb 19, 2025
968506f
feat: Update Policy Library (automated)
actions-user Feb 20, 2025
6d3ad3f
Update script to support Bicep sync
oZakari Feb 20, 2025
d216530
fix: Correct formatting and logic in Invoke-PolicyToBicep.ps1 for def…
jtracey93 Feb 20, 2025
f410b90
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
oZakari Feb 20, 2025
b3b6ccc
feat: Update Policy Library (automated)
actions-user Feb 20, 2025
e2ba37d
Merge branch 'main' of https://github.com/Azure/ALZ-Bicep into patch-…
oZakari Feb 20, 2025
3536b7d
feat: Update Policy Library (automated)
actions-user Feb 20, 2025
ee8e494
Merge branch 'main' of https://github.com/Azure/ALZ-Bicep into patch-…
oZakari Feb 20, 2025
2d173e6
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
oZakari Feb 20, 2025
f06e4a6
Merge branch 'main' of https://github.com/Azure/ALZ-Bicep into patch-…
oZakari Feb 20, 2025
6cf9556
feat: Update Policy Library (automated)
actions-user Feb 20, 2025
e75aafe
Remove allowed null value for defversion
oZakari Feb 20, 2025
8db45e0
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
oZakari Feb 20, 2025
a6512b7
Merge branch 'main' of https://github.com/Azure/ALZ-Bicep into patch-…
oZakari Feb 20, 2025
17518d9
feat: Update Policy Library (automated)
actions-user Feb 20, 2025
52b5567
Add versioning updates to policy def module
oZakari Feb 20, 2025
2acab1f
Set defver to null if empty
oZakari Feb 20, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/wiki/AssigningPolicies.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,9 +63,9 @@ To extend the [ALZ Default Policy Assignments module](https://github.com/Azure/A
1. Copy the entire contents of the relevant `_policyAssignmentsBicepInput.txt` file and replace the variables for the policy assignments metadata ([lines 78 to 202 today in the `alzDefaultPolicyAssignments.bicep` module](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep#L78-L202))
5. Define a new module declaration using the [Policy Assignments module](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/policy/assignments) in the [`alzDefaultPolicyAssignments.bicep` module](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep)
- You could also copy an existing [`alzDefaultPolicyAssignments.bicep` module](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep) policy assignment module declaration that uses the same effect as you require in your new assignment
- [`DeployIfNotExists` effect example - `Deploy-MDFC-Config` policy assignment - `modPolicyAssignmentIntRootDeployMDFCConfig` (lines 242 to 269)](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep#L242-L269)
- [`DeployIfNotExists` effect example - `Deploy-MDFC-Config` policy assignment - `modPolAssiIntRootDeployMDFCConfig` (lines 242 to 269)](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep#L242-L269)
- *Note the use of `parPolicyAssignmentParameterOverrides`*
- [`Deny` effect example - `Deny-Subnet-Without-Nsg` policy assignment - `modPolicyAssignmentIdentDenySubnetWithoutNSG` (lines 445 to 458)](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep#L445-L458)
- [`Deny` effect example - `Deny-Subnet-Without-Nsg` policy assignment - `modPolAssiIdentDenySubnetWithoutNSG` (lines 445 to 458)](https://github.com/Azure/ALZ-Bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep#L445-L458)
- Change the parameter input values to the desired values to assign your new policy
- Refer to the [Policy Assignments module](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/policy/assignments) documentation for parameter information
- These can be "hardcoded" **or** from the associated `.json` file in the `lib`, referenced via a variable generated in step 4, that you have created in the previous steps
Expand All @@ -76,7 +76,7 @@ To extend the [ALZ Default Policy Assignments module](https://github.com/Azure/A

The steps explained in the above section to extend the [ALZ Default Policy Assignments module](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults) still apply and should be followed however you will do this in a separate Bicep file instead.

You will also need to ensure you create unique deployment names for each policy assignment as we do in the [ALZ Default Policy Assignments module](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults) in the variable named `varModuleDeploymentNames` which is referenced for each policy assignment to its associated deployment name.
You will also need to ensure you create unique deployment names for each policy assignment as we do in the [ALZ Default Policy Assignments module](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults) in the variable named `varModDepNames` which is referenced for each policy assignment to its associated deployment name.

## What if I want to exclude specific policy assignments from ALZ Default Policy Assignments?

Expand Down
2 changes: 1 addition & 1 deletion docs/wiki/PolicyDeepDive.md
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ To carry out the instructions in the scenario the operator will require Resource

```kusto
PolicyResources |
where kind =~ 'policyassignments' and tostring(properties.policyDefinitionId) =~ '/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics'
where kind =~ 'policyassignments' and tostring(properties.policyDefinitionId) =~ '/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config_20240319'
| extend
assignmentScope = tostring(properties.scope),
assignmmentNotScopes = tostring(properties.notScopes),
Expand Down
Loading
Loading