Forum Discussion
Azure Blueprint: Allow resource only in specifc resource group
Hello all,
We would like to use blueprint to govern azure subscriptions. Within the blueprint we would like to deploy some kind of "core networking" resource group containing a VNET, which we can achieve using ARM template. So far so good, but we would like to prevent other VNET's being deployed to the subscription. I guess it should be possible somehow using policy and exclude the "core networking" resource group, but I havn't found a way jet.
2 Replies
For the policy, check out the https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#value and the resourcegroup() function.
Something like (not tested):
{ "if": { "allOf": [ { "field": "type", "like": "Microsoft.Network/*" }, { "value": "[resourceGroup().name]", "notEquals": "CoreNetworking" } ] }, "then": { "effect": "deny" } }AFAIK there's no alias for resource group name for policy evaluation.
You could restrict vNICs to a certain vNet using this example:
https://docs.microsoft.com/en-us/azure/governance/policy/samples/use-approved-vnet-vm-nics
You might want to enhance the example to allow an array of allowed vNets for your vNics.
-Michael
