-
Notifications
You must be signed in to change notification settings - Fork 983
/
DENY-ClassicResourceTypesPolicyAssignment.json
126 lines (126 loc) · 6.98 KB
/
DENY-ClassicResourceTypesPolicyAssignment.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"policyEffect": {
"type": "string",
"allowedValues": [
"Deny",
"Audit"
],
"defaultValue": "Deny"
},
"enforcementMode": {
"type": "string",
"allowedValues": [
"Default",
"DoNotEnforce"
],
"defaultValue": "Default"
},
"nonComplianceMessagePlaceholder": {
"type": "string",
"defaultValue": "{enforcementMode}"
}
},
"variables": {
"policyDefinitions": {
"denyClassicResources": "/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749"
},
"policyAssignmentNames": {
"denyClassicResources": "Deny-Classic-Resources",
"description": "Denies deployment of classic resource types under the assigned scope.",
"displayName": "Deny the deployment of classic resources"
},
"nonComplianceMessage": {
"message": "Classic resources {enforcementMode} not be deployed.",
"Default": "must",
"DoNotEnforce": "should"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2022-06-01",
"name": "[variables('policyAssignmentNames').denyClassicResources]",
"properties": {
"description": "[variables('policyAssignmentNames').description]",
"displayName": "[variables('policyAssignmentNames').displayName]",
"policyDefinitionId": "[variables('policyDefinitions').denyClassicResources]",
"enforcementMode": "[parameters('enforcementMode')]",
"nonComplianceMessages": [
{
"message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]"
}
],
"parameters": {
"listOfResourceTypesNotAllowed": {
"value": [
"Microsoft.ClassicCompute/capabilities",
"Microsoft.ClassicCompute/checkDomainNameAvailability",
"Microsoft.ClassicCompute/domainNames",
"Microsoft.ClassicCompute/domainNames/capabilities",
"Microsoft.ClassicCompute/domainNames/internalLoadBalancers",
"Microsoft.ClassicCompute/domainNames/serviceCertificates",
"Microsoft.ClassicCompute/domainNames/slots",
"Microsoft.ClassicCompute/domainNames/slots/roles",
"Microsoft.ClassicCompute/domainNames/slots/roles/metricDefinitions",
"Microsoft.ClassicCompute/domainNames/slots/roles/metrics",
"Microsoft.ClassicCompute/moveSubscriptionResources",
"Microsoft.ClassicCompute/operatingSystemFamilies",
"Microsoft.ClassicCompute/operatingSystems",
"Microsoft.ClassicCompute/operations",
"Microsoft.ClassicCompute/operationStatuses",
"Microsoft.ClassicCompute/quotas",
"Microsoft.ClassicCompute/resourceTypes",
"Microsoft.ClassicCompute/validateSubscriptionMoveAvailability",
"Microsoft.ClassicCompute/virtualMachines",
"Microsoft.ClassicCompute/virtualMachines/diagnosticSettings",
"Microsoft.ClassicCompute/virtualMachines/metricDefinitions",
"Microsoft.ClassicCompute/virtualMachines/metrics",
"Microsoft.ClassicInfrastructureMigrate/classicInfrastructureResources",
"Microsoft.ClassicNetwork/capabilities",
"Microsoft.ClassicNetwork/expressRouteCrossConnections",
"Microsoft.ClassicNetwork/expressRouteCrossConnections/peerings",
"Microsoft.ClassicNetwork/gatewaySupportedDevices",
"Microsoft.ClassicNetwork/networkSecurityGroups",
"Microsoft.ClassicNetwork/operations",
"Microsoft.ClassicNetwork/quotas",
"Microsoft.ClassicNetwork/reservedIps",
"Microsoft.ClassicNetwork/virtualNetworks",
"Microsoft.ClassicNetwork/virtualNetworks/remoteVirtualNetworkPeeringProxies",
"Microsoft.ClassicNetwork/virtualNetworks/virtualNetworkPeerings",
"Microsoft.ClassicStorage/capabilities",
"Microsoft.ClassicStorage/checkStorageAccountAvailability",
"Microsoft.ClassicStorage/disks",
"Microsoft.ClassicStorage/images",
"Microsoft.ClassicStorage/operations",
"Microsoft.ClassicStorage/osImages",
"Microsoft.ClassicStorage/osPlatformImages",
"Microsoft.ClassicStorage/publicImages",
"Microsoft.ClassicStorage/quotas",
"Microsoft.ClassicStorage/storageAccounts",
"Microsoft.ClassicStorage/storageAccounts/blobServices",
"Microsoft.ClassicStorage/storageAccounts/fileServices",
"Microsoft.ClassicStorage/storageAccounts/metricDefinitions",
"Microsoft.ClassicStorage/storageAccounts/metrics",
"Microsoft.ClassicStorage/storageAccounts/queueServices",
"Microsoft.ClassicStorage/storageAccounts/services",
"Microsoft.ClassicStorage/storageAccounts/services/diagnosticSettings",
"Microsoft.ClassicStorage/storageAccounts/services/metricDefinitions",
"Microsoft.ClassicStorage/storageAccounts/services/metrics",
"Microsoft.ClassicStorage/storageAccounts/tableServices",
"Microsoft.ClassicStorage/storageAccounts/vmImages",
"Microsoft.ClassicStorage/vmImages",
"Microsoft.ClassicSubscription/operations"
]
},
"effect": {
"value": "[parameters('policyEffect')]"
}
}
}
}
],
"outputs": {}
}