Azure / Azure/review-checklists
Proposal for Adding Azure Policies to check list and converting Azure Resource Graph Queries to Azure Policies
- Dominant language
- Python
- Stars
- 1.3k
- Forks
- 378
- PR merge metrics
- No merged PRs in 30d
Description
In this repo we are converting statements to Azure Resource Graph Queries. However we can use Azure Policies to audit and policy actions to modify resources to match the statements. Which is aligned with Policy as code approach.
Attaching Excel Sheet that has most of the statement in the review checklist per azure service and
All the built-in Azure Policies from https://github.com/Azure/azure-policy
Custom Community Policies from https://github.com/Azure/Community-Policy
Azure Landing Zone Policies from https://github.com/Azure/Enterprise-Scale/tree/main/src/resources/Microsoft.Authorization
Azure Monitoring Baseline Alerts from https://github.com/Azure/azure-monitor-baseline-alerts/tree/main/patterns/alz
## How To Convert Existing Statements to Azure Policies
Azure resource graph queries are a way of querying the properties and relationships of Azure resources using the Kusto query language. Azure policies are a way of enforcing rules and effects over resources to ensure compliance with standards and best practices.
To convert an existing Azure resource graph query into a policy, we need to follow these steps:
Define the policy effect, such as deny, audit, or append.
Define the policy rule, which is a logical expression that evaluates to true or false for each resource.
Use the where clause of the resource graph query to filter the resources that the policy applies to.
Use the summarize clause of the resource graph query to aggregate the results and check for compliance conditions.
Use the project clause of the resource graph query to select the properties that the policy returns.
We can use existing tools that can help with this task, such as the [ConvertToPolicy](https://github.com/robinchapas/ConvertToPolicy)[ tool by robinchapas](https://github.com/robinchapas/ConvertToPolicy)[](https://github.com/robinchapas/ConvertToPolicy), which is a script that converts a resource graph query into a policy rule.
We can also use the [Azure Resource Graph sample queries for Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/samples/resource-graph-samples)[ article](https://learn.microsoft.com/en-us/azure/governance/policy/samples/resource-graph-samples) to learn from some examples of how to write policy rules based on resource graph queries.
[azpolicy.xlsx](https://github.com/Azure/review-checklists/files/13417535/azpolicy.xlsx)
If this proposal is okay by the community we can work together
Contributor guide
Research direction
Begin by reviewing the attached azpolicy.xlsx and the linked Azure Policy, Community Policy, Enterprise-Scale, and monitoring-baseline sources. Establish which review-checklist statements are in scope and how they map to policies; done means the agreed statements have corresponding Azure Policy coverage and the checklist reflects that mapping.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100