CODEWITHSUNDEEP
azureazure-policyazure-management-groups
Nayden Van
Nayden Van

Reputation: 1569

Azure Management Group Deny all

Sorry for this basic topic but I am pretty confused about azure Management Groups and policy.

I have a production subscription, on which I would like to deny all the manual creation of resource and allow only the creation the resource as code.

Which mean, if I try to create or change a resource from the portal, to get an error, but if I want to create the resource with terraform or bicep, to be able to do so with the terminal.

So what I did, in my Management Groups I added a child group and assigned the subscription. On the child group, I created the policy to deny all the Microsoft.* as follow:

{
 "mode": "All",
 "policyRule": {
   "if": {
     "field": "type",
     "like": "Microsoft.*"
  },
  "then": {
    "effect": "deny"
  }
 }
}

This works just fine, but how can I still be able to create resource with terraform or bicep using the terminal? Or maybe somebody can advice me on a better approach on how to solve this problem please?

Thank you very much

Upvotes: 0

Views: 213

Answers (1)

MoonHorse
MoonHorse

Reputation: 2489

If you apply this policy, it will be valid for service principals as well.

A better approach would be to restrict the RBACs of users(like Reader) and use only a Service Principal to deploy resource to Azure. That's a more simple approach.

Upvotes: 1

Related Questions