Creating Custom Policy in VS Code

00:00

Now

00:01

let's go ahead and create some custom policies in visual studio code

00:05

for our exercise. We will do the following.

00:08

We will use the built in policy that restricts the resource types for resource is created in a specific resource group.

00:17

However,

00:18

instead of denying it will just change this to auditing,

00:22

we will also create a very simple custom policy that audits the naming conventions used in that resource group.

00:31

We will also create one more policy which will require specific tags to be applied to. The resource is in that group.

00:40

When we create resource is in that resource group.

00:43

If we don't specify those tags, the creation of those resource is will be denied.

00:51

At the end, we will bundle all these policies in a single initiative and apply it to the resource group.

00:58

Let's go ahead and do that.

01:02

We'll start with the policy to restrict the resource types allowed in the resource groups.

01:07

There's a built in policy for that.

01:07

We'll just copy that built in policy and modify it slightly.

01:12

We need to go and search for that. Built in definition,

01:17

the name of the policy is called allowed resource types.

01:19

This is the second policy.

01:23

I will open that policy and save it locally to my machine.

01:26

I could say Save as and I'll put it in a new folder called Sai Buri Policies on My Machine.

01:38

I'll just rename it to custom allowed resource type policy. Jason.

01:53

In order to make it a custom policy, we need to remove some of the information. So the first four lines

02:02

we need to leave on Lee the policy rule.

02:05

We'll delete the metadata.

02:08

We'll leave the parameters

02:12

will remove the identifier, the name and the type.

02:16

Now we have a policy,

02:20

which is exactly the same as the built in policy.

02:23

The only thing that we will change is instead of having the deny effect,

02:28

we will have the audit effect, which means that we will not be denied creating Resource is, but we will receive notifications if resource is outside, the specified list are created.

02:45

This is our first policy.

02:46

Let's create two other simple policies.

02:50

We'll create a new file.

02:53

We'll save it in the same location as a chase on file.

03:00

We will call it custom enforced name policy definition. Jason,

03:15

this will have a very simple rule.

03:16

Let me just copy and paste it.

03:23

We will have a single parameter that has named Pattern.

03:29

This pattern can include question marks for letters or hash for numbers.

03:34

If the name doesn't match, this pattern will have audit effect on that policy.

03:38

Let's save that.

03:42

Then we will create one more,

03:46

which will be required. Tags

03:50

will create a new file.

03:52

We'll save it as a Jason.

03:57

We'll call it custom required tags. Policy definition.

04:15

This one will look like this.

04:20

We will have our policy rule.

04:24

If any of those things air false, we will deny the creation of the resource.

04:29

What that means is that we will require each resource to have a tag owner, tag, owner, email and tag department.

04:39

Those are the three custom policies that we created.

04:45

We can deploy these policies using command line interface, but for simplicity, let's go to the portal and do that in the portal.

04:54

Here we are in the portal.

04:56

I'll go to the policy service in the definitions,

05:02

and I'll create a new policy definition.

05:09

I will put this policy definition at the subscription level.

05:19

I will go with audit resource types.

05:28

I'll add some descriptions like policy for auditing resource types.

05:40

I'll go and copy the definition from here and paste it in the field.

05:55

I will save this policy now.

06:00

If you go in filtered by custom policy types, you'll see that I have audit resource types and some other test policy that I have created.

06:10

Let's do one more

06:12

this time.

06:13

We will have the second one, which will be enforced names

06:21

again. We'll put it at the subscription level.

06:31

Well, actually, call it audit resource names.

06:41

This policy audits the naming conventions for the resource is

06:54

we will pace the policy inside the field.

06:58

We'll save it.

07:00

So we have audit resource names, audit resource types.

07:05

I need to fix my naming convention

07:10

the last time that what we do

07:13

is required. Mandatory tags for the resource is

07:24

new Policy definition

07:27

again at the subscription level.

07:32

Require mandatory tag policy.

07:47

Mentor E tags

07:49

require tags

07:58

and we will save it.

08:01

The next thing we will do is we will create initiative definition.

08:13

We will get on Lee the custom policies

08:18

we will add the resource types who will add the resource names will add the mandatory tags

08:26

and we'll call it our custom initiatives.

08:31

This initiative includes three policies

08:41

audit resource types. Audit names for resource is and require mandatory tags.

09:01

We will save this initiative.

09:05

Actually, I forgot to put the name pattern here.

09:11

We will use three letters

09:16

dash ese dash policy and

09:20

maybe five other letters.

09:24

They allow resource types.

09:26

We also need to select the allow resource types for this initiative.

09:33

It takes a little bit toe, actually, load all those resource types.

09:41

Here are the storage account selections.

09:43

We will go and select all of them.

09:48

Which means that this policy will audit every resource that is not storage account related.

10:09

That you is a little bit odd, but

10:18

at last we will go and save the initiative.

10:26

And this is how you create your initiatives and custom policies.