How to use VM imageID's in Azure Policy?

neokg 0
Viewed 32

Azure has a number of built-in VM agent related policies. E.g. for installing the dependency agent, log analytics agent or the new Azure Monitoring Agent via a deployifnotexists effect. Examples are:

  • Configure Linux machines to run Azure Monitor Agent and associate them to a Data Collection Rule
  • Configure Windows machines to run Azure Monitor Agent and associate them to a Data Collection Rule

Since we are only using CIS images from the marketplace our VM's are ignored in the policy evaluation. Both these initatives contain a parameter for additional virtual machine image ID's. It accepts an array of image ID's something like: listOfWindowsImageIdToInclude or listOfLinuxImageIdToInclude. However when I inspect the properties of my VM (ImageReference) the property ID is always empty:

cis image

windows image

If I query the marketplace it shows something like this:

cis images

I already included those Ids in the intiative parameter but without success.

azure-policy azure
1 Answers

Following this documentation (Apply policies to Windows VMs with Azure Resource Manager and Apply policies to Linux VMs with Azure Resource Manager)

Could this policy be:

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.Compute/VirtualMachineScaleSets"
        ]
      },
      {
        "not": {
          "allOf": [
            {
              "field": "Microsoft.Compute/imagePublisher",
              "in": [
                "center-for-internet-security-inc"
              ]
            },
            {
              "field": "Microsoft.Compute/imageOffer",
              "in": [
                "cis-ubuntu-linux-2004-11"
              ]
            },
            {
              "field": "Microsoft.Compute/imageSku",
              "in": [
                "cis-ubuntu2004-11"
              ]
            },
            {
              "field": "Microsoft.Compute/imageVersion",
              "in": [
                "latest"
              ]
            }
          ]
        }
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}

If it doesn't work, please share your JSON policy

Hope this helps!

SoySolisCarlos0
Related