Azure Policy for governance - Mini Project: Build & Apply

Azure Policy for governance

📖 Scenario: You are working as a cloud administrator for a company that wants to enforce rules on their Azure resources to keep them secure and compliant. You will create an Azure Policy that restricts the creation of virtual machines to only specific allowed sizes.

🎯 Goal: Create an Azure Policy definition that restricts virtual machine sizes to a specific list, assign this policy to a resource group, and verify the policy enforcement.

📋 What You'll Learn

Create an Azure Policy definition named allowedVMsizes that restricts VM sizes to Standard_DS1_v2 and Standard_DS2_v2

Create a policy assignment named restrictVMsizesAssignment targeting the resource group TestResourceGroup

Use the policy effect Deny to prevent disallowed VM sizes

Use JSON format for the policy definition and assignment

💡 Why This Matters

🌍 Real World

Azure Policy helps organizations enforce rules and compliance automatically on their cloud resources, preventing misconfigurations and security risks.

💼 Career

Cloud administrators and governance specialists use Azure Policy to maintain control over resource configurations and ensure compliance with company standards.

1

Create the Azure Policy definition JSON

Create a JSON object called policyDefinition that defines an Azure Policy with the name allowedVMsizes. The policy should have a policyRule that denies creation of virtual machines with sizes other than Standard_DS1_v2 and Standard_DS2_v2. Use the if condition to check the Microsoft.Compute/virtualMachines/sku.name property and the effect should be Deny.

Azure

# Your code here to create policyDefinition JSON object

Hint

Use the policyRule with if and then blocks. The if should check the VM size field and deny if not in the allowed list.

2

Create the policy assignment JSON

Create a JSON object called policyAssignment that assigns the policy allowedVMsizes to the resource group TestResourceGroup. The assignment should have the name restrictVMsizesAssignment and use the Deny effect.

Azure

{
  "policyDefinition": {
    "name": "allowedVMsizes",
    "properties": {
      "displayName": "Allowed VM sizes",
      "policyType": "Custom",
      "mode": "All",
      "description": "This policy restricts virtual machine sizes to Standard_DS1_v2 and Standard_DS2_v2.",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "not": {
                "field": "Microsoft.Compute/virtualMachines/sku.name",
                "in": ["Standard_DS1_v2", "Standard_DS2_v2"]
              }
            }
          ]
        },
        "then": {
          "effect": "Deny"
        }
      }
    }
  }
}

# Your code here to create policyAssignment JSON object

Hint

Use the policyAssignment object with name, properties.policyDefinitionId, and properties.scope fields. Replace {subscriptionId} with your subscription ID when deploying.

3

Add parameters to the policy definition

Modify the policyDefinition JSON to add a parameters section that allows specifying the list of allowed VM sizes. Name the parameter allowedSizes with type Array and default value ["Standard_DS1_v2", "Standard_DS2_v2"]. Update the policyRule to use this parameter instead of the hardcoded list.

Azure

{
  "policyDefinition": {
    "name": "allowedVMsizes",
    "properties": {
      "displayName": "Allowed VM sizes",
      "policyType": "Custom",
      "mode": "All",
      "description": "This policy restricts virtual machine sizes to Standard_DS1_v2 and Standard_DS2_v2.",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "not": {
                "field": "Microsoft.Compute/virtualMachines/sku.name",
                "in": ["Standard_DS1_v2", "Standard_DS2_v2"]
              }
            }
          ]
        },
        "then": {
          "effect": "Deny"
        }
      }
    }
  },
  "policyAssignment": {
    "name": "restrictVMsizesAssignment",
    "properties": {
      "displayName": "Restrict VM sizes assignment",
      "policyDefinitionId": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/allowedVMsizes",
      "scope": "/subscriptions/{subscriptionId}/resourceGroups/TestResourceGroup",
      "enforcementMode": "Default"
    }
  }
}

# Your code here to add parameters and update policyRule to use parameters

Hint

Add a parameters section in properties with the allowed sizes array. Use parameters('allowedSizes') in the policyRule instead of the hardcoded list.

4

Complete the policy assignment with parameter values

Update the policyAssignment JSON to include the parameters property that sets allowedSizes to ["Standard_DS1_v2", "Standard_DS2_v2"]. This completes the policy assignment with the parameter values.

Azure

{
  "policyDefinition": {
    "name": "allowedVMsizes",
    "properties": {
      "displayName": "Allowed VM sizes",
      "policyType": "Custom",
      "mode": "All",
      "description": "This policy restricts virtual machine sizes to allowed sizes.",
      "parameters": {
        "allowedSizes": {
          "type": "Array",
          "metadata": {
            "displayName": "Allowed VM sizes",
            "description": "The list of allowed virtual machine sizes.",
            "strongType": "VMSize"
          },
          "defaultValue": ["Standard_DS1_v2", "Standard_DS2_v2"]
        }
      },
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "not": {
                "field": "Microsoft.Compute/virtualMachines/sku.name",
                "in": "[parameters('allowedSizes')]"
              }
            }
          ]
        },
        "then": {
          "effect": "Deny"
        }
      }
    }
  },
  "policyAssignment": {
    "name": "restrictVMsizesAssignment",
    "properties": {
      "displayName": "Restrict VM sizes assignment",
      "policyDefinitionId": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/allowedVMsizes",
      "scope": "/subscriptions/{subscriptionId}/resourceGroups/TestResourceGroup",
      "enforcementMode": "Default",
      # Add parameters property here
    }
  }
}

# Your code here to add parameters property to policyAssignment

Hint

Add the parameters property inside policyAssignment.properties with the allowedSizes value array.

Practice

1. What is the main purpose of Azure Policy in cloud governance?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To enforce rules and ensure resources comply with organizational standards

D. To backup data to external storage

Solution

1. Step 1: Understand Azure Policy's role

   Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

2. Step 2: Compare options to this role

   Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

3. Final Answer:

   To enforce rules and ensure resources comply with organizational standards -> Option C

4. Quick Check:

   Azure Policy = Enforce rules [OK]

Hint: Azure Policy controls rules, not resource creation [OK]

Common Mistakes:

• Confusing Azure Policy with Azure Monitor
• Thinking Azure Policy creates resources
• Mixing Azure Policy with backup services

2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?

easy

A. "effect"

B. "then"

C. "if"

D. "condition"

Solution

1. Step 1: Identify the JSON structure of Azure Policy

   Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

2. Step 2: Confirm the element that defines the action

   The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

3. Final Answer:

   "effect" -> Option A

4. Quick Check:

   Action in Azure Policy = effect [OK]

Hint: "effect" defines the action in Azure Policy JSON [OK]

Common Mistakes:

• Confusing "then" with the action element
• Using "condition" instead of "if"
• Missing the "effect" element entirely

3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The storage account creation will be allowed without encryption

B. The storage account creation will be denied

C. The policy will audit the storage account but allow creation

D. The policy will ignore the encryption setting

Solution

1. Step 1: Analyze the condition in the policy

   The policy checks if encryption.enabled is false (not enabled).

2. Step 2: Understand the effect when condition matches

   The effect is "deny", so if encryption is false, creation is blocked.

3. Final Answer:

   The storage account creation will be denied -> Option B

4. Quick Check:

   Condition false + effect deny = block creation [OK]

Hint: "deny" effect blocks resource creation if condition true [OK]

Common Mistakes:

• Thinking "deny" allows creation but logs it
• Confusing "deny" with "audit" effect
• Ignoring the condition check on encryption

4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The value "false" should be a boolean false, not a string

B. The "effect" should be "audit" instead of "deny"

C. The "field" name is incorrect for encryption

D. The policy is missing a "parameters" section

Solution

1. Step 1: Check the data type of the "equals" value

   The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

2. Step 2: Correct the data type to boolean

   Changing "false" (string) to false (boolean) fixes the condition to match properly.

3. Final Answer:

   The value "false" should be a boolean false, not a string -> Option A

4. Quick Check:

   Boolean false, not string "false" fixes policy [OK]

Hint: Use boolean false, not string "false" in conditions [OK]

Common Mistakes:

• Using string "false" instead of boolean false
• Changing effect to audit instead of deny
• Assuming field name is wrong without checking

5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?

hard

A. "deny"

B. "deployIfNotExists"

C. "append"

D. "audit"

Solution

1. Step 1: Understand the requirement to report but not block

   You want to find resources missing the tag but still allow creation.

2. Step 2: Identify the effect that audits without blocking

   The "audit" effect reports non-compliance but does not prevent resource creation.

3. Step 3: Compare other effects

   "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

4. Final Answer:

   "audit" -> Option D

5. Quick Check:

   Audit effect reports without blocking [OK]

Hint: Use "audit" to report issues without blocking [OK]

Common Mistakes:

• Using "deny" which blocks resource creation
• Confusing "append" with audit
• Choosing "deployIfNotExists" which deploys resources