As we all know (or maybe you don’t), deploying things in the cloud like Microsoft Azure is very easy since its just a couple of clicks in your browser. And since it is that easy, it brings about one big problem, which is that it is easy to make mistakes or deploy things that you shouldn’t be deploying. Sometimes to due to the company’s budgets, policies or compliance, there are situations where you want to be able to restrict what resources can be deployed in Azure.
Luckily, Azure has a built-in solution for this called Azure Policy. Azure Policy is basically a set of rules you can assign to a subscription or resource group to enforce or restrict what resources can be deployed or how it is deployed.
Now that we got the premise out of the way, let’s get to the fun part: seeing Azure Policy in action!
The goal of this lab is to require all resources in a specific resource group to have the Environment = Lab tag.
Firstly, we go to the Azure Policy section then definitions and search for the policy “Require a tag and its value on resources”
Then we click on Assign policy to assign the policy:
In the scope section, we can specify which resource group we want to apply the policy to, we’ll be applying it to the Azure-Policy-Test resource group in this case:
Then in the Parameters section, we specify the required Tag name and value for the resources, which is Environment for the name and Lab for the value:
Optionally you can also set a non-compliance message:
Once the policy is assigned, you can see it under the Assignments section in Azure Policy:
So now that we assigned the policy to our resource group, we test to see if it actually works! So in this case, we can try creating a resource without the tag and see if the policy will stop us from creating it.
I’m just going to create a simple storage account in the resource group:
Then when I go straight to Review + create, I get this error:
And if you click on the Tags section with the red X on it, you’ll see the compliance message that we set for the policy:
Awesome! Looks like our policy is working as expected.
So as we can see, Azure Policy is a great built-in tool to keep track and enforce compliance of your Azure resources through your subscription and resource groups. So the next time you need to make sure somebody doesn’t make a mistake in your Azure tenant, you can use Azure Policy to enforce that!