Roles answer the question of who may do something. They say nothing, though, about how it is done. An Owner may create a database in a region in the USA, and a Contributor may create a resource without tags. For rules like these, which apply to everyone whatever their role, there is Azure Policy. In this lesson you give the Kladde's subscription two rules: resources only in allowed EU regions, and every new resource inherits its resource group's tags. You also learn what Microsoft's EU data boundary promises and where it ends.

Definition, initiative, assignment

Azure Policy has three building blocks:

  • A policy definition is a rule in JSON: a condition (if) and an effect (then), plus parameters. Azure comes with hundreds of built-in definitions; custom ones are possible.
  • An initiative (also called a policy set) bundles several definitions, such as all the rules of a security standard.
  • An assignment attaches a definition or initiative to a scope, that is, to a management group, a subscription, a resource group or a resource, with concrete values for the parameters. Only the assignment takes effect. Like roles, assignments apply to everything below the scope.

An assignment also has three adjusting screws:

  • Exclusions (notScopes): scopes below it to which it doesn't apply, such as a resource group for experiments.
  • Exemptions: a single resource is exempted from the rule, with a reason and an expiry date.
  • Enforcement (enforcementMode): with DoNotEnforce, Azure evaluates the rule but doesn't enforce it. That way you see what a new rule would hit before it does.

A definition worth looking at is “Allowed locations”, which you'll assign in a moment. Its logic, simplified:

JSON
{
  "mode": "Indexed",
  "parameters": {
    "listOfAllowedLocations": { "type": "Array" },
    "effect": { "type": "String", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }
  },
  "policyRule": {
    "if": {
      "allOf": [
        { "field": "location", "notIn": "[parameters('listOfAllowedLocations')]" },
        { "field": "location", "notEquals": "global" },
        { "field": "type", "notEquals": "Microsoft.AzureActiveDirectory/b2cDirectories" }
      ]
    },
    "then": { "effect": "[parameters('effect')]" }
  }
}

Read out, this means: if a resource's location isn't in the list and isn't global and the resource isn't a certain directory type, then the effect takes place, by default Deny. Two details are important:

  • "mode": "Indexed" means: the rule checks only resources that can have tags and a location. Resource groups aren't among them. For them there is a definition of its own, “Allowed locations for resource groups”.
  • Resources with the location global are exempt. These are the non-regional services from lesson 3.1.1, such as Azure Front Door or Azure DNS. Otherwise they would have no allowed location at all.