Add Missing Databricks Default Policy Assignments to Corp MG to Match ALZ Accelerator Experience

modules/archetypes/lib/archetype_definitions/archetype_definition_es_corp.tmpl.json

@@ -2,7 +2,10 @@
     "es_corp": {
         "policy_assignments": [
             "Deny-Public-Endpoints",
-            "Deploy-Private-DNS-Zones"
+            "Deploy-Private-DNS-Zones",
+            "Deny-DataB-Pip",
+            "Deny-DataB-Sku",
+            "Deny-DataB-Vnet"
         ],
         "policy_definitions": [],
         "policy_set_definitions": [],

modules/archetypes/lib/policy_assignments/policy_assignment_es_deny_databricks_public_ip.tmpl.json

@@ -0,0 +1,22 @@
+{
+  "name": "Deny-DataB-Pip",
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2019-09-01",
+  "properties": {
+    "description": "Prevent the deployment of Databricks workspaces that do not use the noPublicIp feature to host Databricks clusters without public IPs.",
+    "displayName": "Prevent usage of Databricks with public IP",
+    "notScopes": [],
+    "parameters": {
+      "effect": {
+        "value": "Deny"
+      }
+    },
+    "policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policyDefinitions/Deny-Databricks-NoPublicIp",
+    "scope": "${current_scope_resource_id}",
+    "enforcementMode": "Default"
+  },
+  "location": "${default_location}",
+  "identity": {
+    "type": "None"
+  }
+}

modules/archetypes/lib/policy_assignments/policy_assignment_es_deny_databricks_sku.tmpl.json

@@ -0,0 +1,22 @@
+{
+  "name": "Deny-DataB-Sku",
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2019-09-01",
+  "properties": {
+    "description": "Enforces the use of Premium Databricks workspaces to make sure appropriate security features are available including Databricks Access Controls, Credential Passthrough and SCIM provisioning for AAD.",
+    "displayName": "Enforces the use of Premium Databricks workspaces",
+    "notScopes": [],
+    "parameters": {
+      "effect": {
+        "value": "Deny"
+      }
+    },
+    "policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policyDefinitions/Deny-Databricks-Sku",
+    "scope": "${current_scope_resource_id}",
+    "enforcementMode": "Default"
+  },
+  "location": "${default_location}",
+  "identity": {
+    "type": "None"
+  }
+}

modules/archetypes/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json

@@ -0,0 +1,22 @@
+{
+  "name": "Deny-DataB-Vnet",
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2019-09-01",
+  "properties": {
+    "description": "Enforces the use of vnet injection for Databricks workspaces.",
+    "displayName": "Enforces the use of vnet injection for Databricks",
+    "notScopes": [],
+    "parameters": {
+      "effect": {
+        "value": "Deny"
+      }
+    },
+    "policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policyDefinitions/Deny-Databricks-VirtualNetwork",
+    "scope": "${current_scope_resource_id}",
+    "enforcementMode": "Default"
+  },
+  "location": "${default_location}",
+  "identity": {
+    "type": "None"
+  }
+}