Questions[azure-policies](server)

We create a virtual machine that needs 2 extensions, for that we define and assign 2 customs policies, also we create and activate remediation task to make sure that all virtual machines (new ad old vms) have these 2 extensions. Everything is done with Azure CLI.

The problem is that some times, remediation is activated immediately, or not at all even after 2 hours, and sometimes compliance doesn't detect the virtual machines, sometimes yes it does. But when we activate remdiation mannually, it works without problem for all vms.

In our terraform code , remediation is activated just after creating the vms, policies definition and assignment.

What can be the cause of that? Is there a question of time to wait before executing remediation?

I want to give a specific RBAC to a user so that he can create a NIC but not to modify. As a matter of fact, what it is aimed is that he shouldn't have permission to change the dynamic ip to static ip and change the ip address of the NIC.

I have checked the RBACs of NIC, but it seems that if he has Microsoft.Network/networkInterfaces/write permission , he can create a network interface or update an existing network interface. So this Rbac is not as detailed as i want. I have also tried to give all permissions but not Microsoft.Network/networkInterfaces/read. In that case, the NIC can be created but i can neither see the ip of the nic nor ssh/rdp to the VM. So it is not a solution for me.

I have checked the built-in Azure Policies, but there isn't nothing good for my needs.

Any idea?

I'm looking to create a number of Azure policies using infrastructure as code.

The MS Documentation advises a structure as below:

.
|
|- policies/  ________________________ # Root folder for policy resources
|  |- policy1/  ______________________ # Subfolder for a policy
|     |- policy.json _________________ # Policy definition
|     |- policy.parameters.json ______ # Policy definition of parameters
|     |- policy.rules.json ___________ # Policy rule
|     |- assign.<name1>.json _________ # Assignment 1 for this policy definition
|     |- assign.<name2>.json _________ # Assignment 2 for this policy definition
|  |- policy2/  ______________________ # Subfolder for a policy
|     |- policy.json _________________ # Policy definition
|     |- policy.parameters.json ______ # Policy definition of parameters
|     |- policy.rules.json ___________ # Policy rule
|     |- assign.<name1>.json _________ # Assignment 1 for this policy definition
|     |- assign.<name2>.json _________ # Assignment 2 for this policy definition
|

This makes sense, but all examples of policy definitions I've seen include the parameter definitions; so I don't see the value in having the separate policy.parameters.json file if it's just duplicating information.

Question

Is there a way to avoid this duplication; e.g. by having the policy.json file refer to the policy.parameters.json file instead of copying its content, or is there some value added by having this duplication?

(The same scenario occurs for the rules file; I assume the answer for that section would be the same...)

Example of this duplication

From the Azure Community Policies repo:

Policy File includes these lines:

"parameters": {
  "tagName": {
    "type": "String",
    "defaultValue": "DateCreated",
    "metadata": {
      "displayName": "Tag Name",
      "description": "Name of the tag, such as 'Date'"
    }
  }
}

Parameters file exactly duplicates the content found under the above parameters section above (well almost; in this case the description differs slightly, but that feels like a mistake rather than a justification):

{
  "tagName": {
    "type": "String",
    "defaultValue": "DateCreated",
    "metadata": {
      "displayName": "Tag Name",
      "description": "Name of the tag, such as 'DateCreated'"
    }
  }
}