Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updated known issues list of resource types excluded from policy eval #1306

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Updated known issues list of resource types excluded from policy eval #1306

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,13 +228,31 @@ All Databricks resources bypass policy enforcement at creation time. Databricks

### Resources that are exempt from policy evaluation
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should also add a section about types that are marked 'internal' in operations api - eg microsoft.devtestlab/schedules

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@varunkumta - can you point me to where I can find these?


Resource types in the following namespaces are excluded from policy evaluation:
- Microsoft.Resources/*, except resource groups and subscriptions.
- For example, `Microsoft.Resources/deployments` and `Microsoft.Resources/templateSpecs` are not evaluated by policy.
- Microsoft.Billing/*
- Microsoft.Capacity/reservationOrders/*
- Microsoft.Help/*
- Microsoft.Diagnostics/*

The following resource types are also excluded from policy evaluation:
- Microsoft.Automation/automationAccounts/jobs
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these are excluded only from brownfield evaluation, not greenfield - so maybe should be moved to the section below - though I'm not sure if they're all due to scalability issues, or due to not following the RPC (not supporting list calls at subscription level for example)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@varunkumta are you talking about Microsoft.Automation/automationAccounts/jobs only, or all the resource types in this new list?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all

- Microsoft.Cdn/cdnWebApplicationFirewallManagedRuleSets
- Microsoft.Cdn/edgenodes
- Microsoft.classicNetwork/ExpressRouteCrossConnections
- Microsoft.Compute/restorePointCollections/restorePoints
- Microsoft.Databricks/workspaces/dbWorkspaces
- Microsoft.DocumentDb/databaseAccounts/privateEndpointConnectionProxies
- Microsoft.KeyVault/vaults/secrets
- Microsoft.KubernetesConfiguration/extensions
- Microsoft.Maintenance/configurationAssignments
- Microsoft.Maintenance/applyUpdates
- Microsoft.Security/assessments
- Microsoft.SecurityInsights/incidents
- Microsoft.ServiceBus/namespaces/topics
- Microsoft.Sql/Servers/databases/recommendedSensitivityLabels

### Resource types that exceed current enforcement and compliance scale

There some resource types that are generated at very high scale. These are not suitable for management by Azure Policy because the enforcement and compliance checks create overhead that can negatively impact the performance of the API itself. Most of these are not significant policy scenarios, but there are a few exceptions.
Expand Down