Hi guys, today in this article we will discuss about “what is Azure Policy?” In this article we will cover all the topics related to Azure policy and we’ll cover its assets as well. The Azure Policy is a service in Azure that permits you to produce policies that enforce and manage the properties of a resource.
What is Azure Policy?
The Azure Policy is a free Azure service that permits you to make policies, and assign them to resources, and receive alerts or take action in cases of non-compliance with these policies.
The Azure Policy permits you to make sure that all resources are configured with required services, and it will tell you when systems are out of compliance. So if you want all of your resources to be configured with Azure Backups, for example, it will either alert you when a VM does not have Azure Backups configured or can automatically configure Azure Backups on that VM.
The Azure Policy is used by 100% of Azure’s top 300 enterprise users and is a critical part of any mature Azure deployment. As a part of a broad Azure governance apply, Azure Policy ensures that individuals on the far side of your central IT team (i.e. developers and LOB teams) will still have access to cloud resources, and might launch resources on demand, while not sacrificing security and compliance. The basic building blocks of Azure Policy are:
- Policy definition: Describes resource compliance and what effect to take when resources are non-compliant. (JSON)
Example: Example: prohibit the list of locations wherever users will deploy resources.
- Initiative: A collection of policy definitions that all contribute towards one overarching goal.
Example: All the policies that communicate to billing can be grouped in one edge.
- Policy or inventiveness assignment: It describes where the policy is applied. And it can be a resource group or subscription.
Example: The policy to limit the list of locations wherever users will deploy resources is applied solely to the finance team’s resource cluster, and to not the Dev team’s resource cluster
Control the response to an evaluation:-
The business rules for controlling non-compliant resources differ widely between organizations. For examples of how an organization wants the platform to reply to a non-compliant resource include:-
- To deny the resource change
- To Log the change to the resource
- To Alter the resource before the change
- To Alter the resource after the change
- To deploy related compliant resources
The Azure Policy makes each of these business responses possible through the application of effects. The effects are set within the policy rule portion of the policy definition.
Remediate non-compliant resources:-
While these effects mainly affect a resource as the resource is created or updated, the Azure Policy also supports dealing with current non-compliant resources without needing to alter that resource. For additional data regarding creating existing resources compliant, see remediating resources.
Getting started with Azure Policy:-
- Azure Policy and Azure RBAC:
There are many important differences between Azure Policy and Azure role-based access control (Azure RBAC). The Azure Policy evaluates state by examining properties on resources that area units portrayed in Resource Manager and properties of some Resource suppliers. The Azure Policy does not restrict actions. The Azure Policy ensures that resource state is compliant to your business rules without fear that an international organization agency created the modification or that an international organization agency has permission to make a modification. For some Azure Policy resources, such as policy definitions, initiative definitions, and assignments, are visible to all users. This design enables transparency to all users and services for what policy rules are set in their environment.
The Azure RBAC focuses on managing user actions at different scopes. If management of associate degree action is needed, then Azure RBAC is that the correct tool to use. Even if a person has access to perform associate degree action, if the result is a non-compliant resource, Azure Policy still blocks making or updating. The combination of Azure RBAC and Azure Policy provides full scope management in Azure.
- Azure RBAC permissions in Azure Policy:-
The Azure Policy has several permissions, called operations, in 2 Resource Providers:
• Microsoft. Authorization
• Microsoft. Policy Insights
Many different Built-in roles grant permission to Azure Policy resources. The Resource Policy gives role to include most of Azure Policy operations. Owner has full rights. Both Contributor and Reader have access to all or any scan Azure Policy operations. The contributor could trigger resource remedy, however cannot produce definitions or assignments. The user Access Administrator is important to grant the managed identity on DeployIfNotExists or modify assignments necessary permissions.
Azure Policy objects:-
Policy definition:
The journey making and implementing a policy in Azure Policy begins with creating a policy definition. Each policy definition has conditions below that it’s enforced. And, it’s an outlined impact that takes place if the conditions area unit met.
In Azure Policy, we provide many integral policies that are unit accessible by default. For example:
- Allowed Storage Account SKUs (Deny): Determines if a storage account being deployed is at intervals a group of SKU sizes. Its impact is to deny all storage accounts that do not adhere to the set of outlined SKU sizes.
- Allowed Resource sort (Deny): Defines the resource varieties that you just will deploy. Its impact is to deny all resources that are not a part of this outlined list.
- Allowed Locations (Deny): Restricts the accessible locations for brand new resources. Its impact is employed to enforce your geo-compliance needs.
- Allowed Virtual Machine SKUs (Deny): Specifies a group of virtual machine SKUs that you just will deploy.
- Add a tag to resources (Modify): Applies a needed tag and its default worth if it is not nominal by the deploy request.
- Not allowed resource varieties (Deny): Prevents a listing of resource varieties from being deployed.
Initiative definition:-
An initiative definition could be an assortment of policy definitions that are tailored toward achieving a singular overarching goal. Initiative definitions alter managing and assignment policy definitions. They alter by grouping a group of policies joined by a single item. For instance, you’ll produce AN initiative titled modify watching in Azure Security Centre, with a goal to watch all the accessible security recommendations in your Azure Security Centre.
Under this initiative, you’d have policy definitions such as:
Monitor unencrypted SQL info in Security Centre – For watching unencrypted SQL databases and servers.
Monitor OS vulnerabilities in Security Centre – For watching servers that do not satisfy the organized baseline.
Monitor missing endpoint Protection in Security Centre – For watching servers while not AN put in endpoint protection agent.
Benefits of Azure Policy:-
The Azure Policy is a service in Azure that permits you to produce polices that enforce and management the properties of a resource. The Azure Policy evaluates state by examining properties on resources that area unit portrayed in Resource Manager and properties of some Resource suppliers. The Azure Policy does not restrict actions. The benefits are as follows:-
- It provides a mechanism of auditing nuanced configurations of Azure resources.
- It blocks resource configurations that are non-compliant.
- It supports the flexibility to “Deploy If Not Exists” (DINE Policy Affect).
- It gives developers the liberty to use their tool of alternative.
Conclusion:-
So far we have covered all the topics related to Azure Policy. The Azure Policy is a free Azure service that permits you to make policies, and assign them to resources, and receive alerts or take action in cases of non-compliance with these policies. I hope this article enhances your way to Azure policy.
Thank You!
- DevOps Certified Professionals (DCP)
- Site Reliability Engineering Certified Professionals (SRECP)
- Master in DevOps Engineering (MDE)
- DevSecOps Certified Professionals (DSOCP)
URL - https://www.devopsschool.com/certification/
My Linkedin - https://www.linkedin.com/in/rajeshkumarin
- Best AI tools for Software Engineers - November 4, 2024
- Installing Jupyter: Get up and running on your computer - November 2, 2024
- An Introduction of SymOps by SymOps.com - October 30, 2024
