Let’s break down the provided Azure Policy code shown below line by line. This policy is designed to enforce a specific tag (CostCenter) on resources by modifying them if the tag is missing. Here’s the detailed explanation:
Code Breakdown
"policyRule": {
"if": {
"field": "tags['CostCenter']",
"exists": "false"
},
"then": {
"effect": "modify",
"details": {
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
],
"operations": [{
"operation": "addOrReplace",
"field": "tags['CostCenter']",
"value": "[resourcegroup().tags['CostCenter']]"
}]
}
}
}
1. policyRule Section
This is the main section that defines the logic of the policy. It consists of two parts: if (the condition) and then (the action to take if the condition is met).
2. if Condition
"if": {
"field": "tags['CostCenter']",
"exists": "false"
}
3. then Action
"then": {
"effect": "modify",
"details": {
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
],
"operations": [{
"operation": "addOrReplace",
"field": "tags['CostCenter']",
"value": "[resourcegroup().tags['CostCenter']]"
}]
}
}
- Purpose: This defines the action to take if the
if condition is true (i.e., the CostCenter tag is missing).
effect: modify
The modify effect is used to change the resource to bring it into compliance.
In this case, it will add or replace the CostCenter tag on the resource.
details Section
This section specifies how the modify effect will be applied.
roleDefinitionIds
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
]
operations
"operations": [{
"operation": "addOrReplace",
"field": "tags['CostCenter']",
"value": "[resourcegroup().tags['CostCenter']]"
}]
Purpose: Defines the specific operation to perform on the resource.
operation: addOrReplace:
- This operation will add the tag if it doesn’t exist or replace its value if it already exists.
field: tags['CostCenter']:
- Specifies the target field to modify, which is the
CostCenter tag.
value: [resourcegroup().tags['CostCenter']]:
This is a policy function that retrieves the value of the CostCenter tag from the resource group that the resource belongs to.
The tag value is inherited from the resource group and applied to the resource.
How This Policy Works
Evaluation:
The policy evaluates whether the CostCenter tag exists on a resource.
If the tag is missing, the condition (if) evaluates to true.
Action:
The policy applies the modify effect.
It uses the Contributor role to add or replace the CostCenter tag on the resource.
The value of the CostCenter tag is inherited from the resource group.
Result:
If the CostCenter tag is missing, it will be added to the resource with the value from the resource group.
If the CostCenter tag already exists but has a different value, it will be replaced with the value from the resource group.
Example Scenario
Resource Group:
- Has a
CostCenter tag with the value Finance.
Resource:
- Does not have a
CostCenter tag.
Policy Action:
- The policy adds the
CostCenter tag to the resource with the value Finance (inherited from the resource group).
Key Points
Tag Inheritance: This policy ensures that resources inherit the CostCenter tag from their resource group, promoting consistency.
Compliance: The modify effect automatically brings non-compliant resources into compliance by adding or updating the tag.
Role-Based Access: The policy requires the Contributor role to perform the modification, ensuring proper permissions are in place.
Roberto w/assistance from DeepSeek
