I would like to create a policy that automatically applies a delete retention policy of 14 days to every new storage created. I think that this is possible by using a deployIfNotExists policy, but I was not able to find a sample JSON or anything on the Internet.
How to enforce that Delete Retention is configured on Azure Storage by using a deployIfNotExists policy?
Viewed 336
2 Answers
I spoke with Microsoft, and they uploaded an example that worked fine. This would be the json extracted from Community-Policy:
{
"properties": {
"displayName": "Deploy Soft-Delete for Blobs",
"mode": "All",
"description": "This policy enables soft-delete for blobs.",
"parameters": {
"retentionInDays": {
"type": "Integer",
"minValue": 1,
"maxValue": 365,
"defaultValue": 7,
"metadata": {
"displayName": "Retention in days",
"description": "This defines how long the deleted object should be retained for. Allowed values are 1 to 365."
}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
{
"field": "kind",
"in": [
"Storage",
"StorageV2",
"BlobStorage",
"BlockBlobStorage"
]
}
]
},
"then": {
"effect": "DeployIfNotExists",
"details": {
"type": "Microsoft.Storage/storageAccounts/blobServices",
"existenceCondition": {
"field": "Microsoft.Storage/storageAccounts/blobServices/default.deleteRetentionPolicy.enabled",
"equals": true
},
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
],
"deployment": {
"properties": {
"mode": "incremental",
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"storageAccountName": {
"type": "string"
},
"retentionInDays": {
"type": "int"
}
},
"variables": {},
"resources": [
{
"name": "[concat(parameters('storageAccountName'), '/default')]",
"type": "Microsoft.Storage/storageAccounts/blobServices",
"apiVersion": "2019-06-01",
"properties": {
"deleteRetentionPolicy": {
"enabled": true,
"days": "[parameters('retentionInDays')]"
}
}
}
],
"outputs": {}
},
"parameters": {
"storageAccountName": {
"value": "[field('name')]"
},
"retentionInDays": {
"value": "[parameters('retentionInDays')]"
}
}
}
}
}
}
}
}
}
You can try the code below(by the way, no time to test it at my side):
{
"mode":"All",
"policyRule":{
"if":{
"field":"type",
"equals":"Microsoft.Storage/storageAccounts"
},
"then":{
"effect":"deployIfNotExists",
"details":{
"type":"Microsoft.Storage/storageAccounts",
"roleDefinitionIds":[
"xxx"
],
"deployment":{
"properties":{
"mode":"incremental",
"template":{
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion":"1.0.0.0",
"parameters":{
"storageAccountName":{
"type":"String",
"metadata":{
"description":"storageAccountName"
}
},
"location":{
"type":"String",
"metadata":{
"description":"location"
}
}
},
"variables":{
},
"resources":[
{
"type":"Microsoft.Storage/storageAccounts",
"apiVersion":"2019-06-01",
"name":"[parameters('storageAccountName')]",
"location":"[parameters('location')]",
"resources":[
{
"name":"default",
"type":"Microsoft.Storage/storageAccounts/managementPolicies",
"apiVersion":"2019-06-01",
"properties":{
"policy":{
"rules":[
"xxx"
]
}
}
}
]
}
],
"outputs":{
}
},
"parameters":{
"storageAccountName":{
"value":"[field('Name')]"
},
"location":{
"value":"[field('location')]"
}
}
}
}
}
}
},
"parameters":{
}
}
Here is the details of the json format of Life cycle management.
Related