Azure / Azure/azure-policy

[Preview]: Assign Built-In User-Assigned Managed Identity to Virtual Machines contains hardcoded location

Open
#1,004 4 comments 4 reactions 0 assignees View on GitHub
Dominant language
Open Policy Agent
Stars
1.7k
Forks
1.2k
Avg merge
2d 54m
Merged PRs (30d)
3

Description

The policies below contain a hardcoded location of 'EASTUS' which causes compliancy issues, because for some organisations this location might not be allowed. The location seems to be used amongst others for the resourcegroup that contains the userassigned identity.

[Preview]: Assign Built-In User-Assigned Managed Identity to Virtual Machines
/providers/Microsoft.Authorization/policyDefinitions/d367bd60-64ca-4364-98ea-276775bddd94

[Preview]: Assign Built-In User-Assigned Managed Identity to Virtual Machine Scale Sets
/providers/Microsoft.Authorization/policyDefinitions/516187d4-ef64-4a1b-ad6b-a7348502976c

Could you make the location configurable via a policy parameter in the policies above and in the initiative which use these policies such as:

Deploy Windows Azure Monitor Agent with user-assigned managed identity-based auth and associate with Data Collection Rule
/providers/Microsoft.Authorization/policySetDefinitions/0d1b56c6-6d1f-4a5d-8695-b15efbea6b49

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate policy definitions d367bd60-64ca-4364-98ea-276775bddd94 and 516187d4-ef64-4a1b-ad6b-a7348502976c, then inspect where EASTUS is used. Check the initiative 0d1b56c6-6d1f-4a5d-8695-b15efbea6b49 and related uses of these policies; done means the location can be supplied through a policy parameter everywhere required.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.