Policy Definitions, Assignments and Parameters

00:03

the process of implementing azure policy has three steps

00:06

defining the policy where you describe what the policy conditions and effects are.

00:11

Assigning the policy where you describe the scope at which the policy will take place. As we mentioned, the scope can vary from management group to subscription, resource group or individual resource, and once the policy is assigned,

00:23

it is continuously evaluated against the properties of the resource is that are within the scope and reports are generated.

00:30

Let's look at how the policy definitions are created.

00:35

Policy definitions are Jason Files that have defined schema.

00:40

Each definition contains the following elements

00:45

mode. There are two types of modes.

00:48

Resource manager modes and resource provider modes.

00:53

The Resource Manager modes can all be for evaluating all resource groups and resource types or indexed for evaluating Onley resource types that support tags and locations.

01:03

The resource provider nodes are still in preview mode, and there are only three resource provider modes. Currently,

01:11

Microsoft Container Service Data,

01:12

Microsoft Kubernetes Data

01:15

and Microsoft Keeve all data for managing vaults and certificates.

01:21

The next element is the parameters element.

01:23

The parameter has a name type of metadata as well as an optional default value and allowed values Properties

01:30

parameters help you simplify the policy management by reducing the number of policies you need to create and reuse those policies for different scenarios.

01:38

The parameters can be specified at the time of policy assignment as well.

01:44

The default value is used in case the parameter is not explicitly specified during assignment.

01:49

The allowed values can restrict what values could be specified at the time of the assignment.

01:53

Parameters are also used in the rule section, which we will discuss shortly.

01:59

Next. There are display names and descriptions for the policies.

02:04

Those are user friendly names and descriptions that you will see in the azure management portal, for example,

02:09

and it is useful to identify and understand the purpose of the policy. In the reports,

02:15

Display name is limited to 128 characters, while the description is limited to 512 characters.

02:23

Last is the policy rule, which is the most important part of the policy.

02:28

It consists of one arm or if then blocks the if block contains one or more conditions that determine when the policy is enforced,

02:37

you can use logical operations in the if block

02:40

the then block determines what the effect is. If the condition in the if block is fulfilled,

02:46

there is an extensive list of logical operators and conditions that you can use in the F block.

02:53

We will look more into the grimmer details later in this course when we develop a custom policy. But for now, it's enough to know that you have a lot of flexibility in the if block that allows you to create all kinds of conditions.

03:05

You can also use various effects in the den block.

03:08

You can deny actions. If the policies violated, you can modify resource properties with a pen or modify,

03:15

or you could just audit properties and so on.

03:19

Once again, we will look into details later in the course.

03:23

One important thing to remember is that policies have an explicit deny action.

03:28

This is important to know when you design your policy structure and assign it to a scope.

03:31

Let's see now what you can do once you have the policy definition.

03:38

As we mentioned before,

03:39

the policy can be assigned to take place within a specific scope Management group. Subscription resource group and individual resource

03:49

scope refers to all the management groups, subscriptions, resource groups and resource is that the policy definition is assigned to

03:57

assignments are inherited by all. Child resource is

04:00

for our example. The policy definition is assigned to the management group. All subscriptions and the resource group and resource is

04:08

that are within this management group will have the policy.

04:12

However, you can exclude the sub scope from the policy assignment.

04:15

For example,

04:16

if you want to deny the creation of a specific resource and subscription but allow its creation in just a single resource group, you can exclude the resource group from the policy.

04:28

One typical example is if you want to have a single veena for a subscription and prevent developers creating Venus and other resource groups except the networking resource group,

04:38

you can exclude the networking research group from the scope, and you can grant access on Lee to specific users to create. Resource is in that group.