Allow deployments only from Terraform using Azure Policy

Hi@Logan

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hi @Venkat V, Thanks for your comments. As it can block is there a way where we can block by identifying users or based on email address something?

Hi@Logan

Azure Policy applies only to management groups, subscriptions and resource groups. It is not possible to assign Azure Policy to a service principal. you can follow the Ms Doc for more information about Azure Policy assignment.

Azure Conditional Access policies in Azure AD can be used to block or restrict user access based on conditions such as user group membership, location, or sign-in risk. This allows you to set policies that limit access to resources based on the user's identity or email.

You could implement a custom solution using Azure Automation or Functions to monitor user activities or access patterns and take actions (like blocking users) based on your criteria (like specific email addresses or conditions).

Hi @Logan

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hi Venkat V,

It wasn't very helpful, which is why I did some additional research but still couldn't find a solution. I understand that it's not available and we may need to think outside the box to figure out how we can prevent resource creation or modification, even if the user has permission to do so, but it should be only allowed from the Service Principal.

The reason I don't want to apply RBAC is that if the Terraform pipeline doesn't work, we might have to relax the policy and deploy it manually.

@Logan My sincere apologies for the delayed response!

From your post I understand that you want to allow deployments only through Terraform using Azure policy. You could leverage identity-based exemptions, which is currently in private preview, to achieve this scenario. With this, you’d be able to apply a policy to prevent resource creation or modification, then create an exemption for that assignment which would allow the Terraform pipeline’s Service Principal ID to bypass the policy. Refer to the document link - https://learn.microsoft.com/en-us/azure/governance/policy/concepts/exemption-structure for details on identity-based exemption private preview.

Let us know if you have any questions!

Hi @SadiqhAhmed-MSFT

Looks like the link provided is incorrect or I can't see the identity-based exemption based references.

@Logan Sorry for the inconvenience. It is not in the public documentation yet because it is in private preview. The general structure of identity-based exemptions will look like this:

Example:
Assume you want to assign the built-in policy definition Allowed virtual machine size SKUs in your subscription to ensure that only A-family VMs can be deployed to keep cost down. You name the Policy assignment CostMgmt. However, certain engineers in your organization should be able to deploy higher-SKU, more expensive VMs for specific workloads and purposes. They should be able to bypass this policy. So, you create this exemption:

Now you’re all set! When a member of deploys a higher-SKU VM such as Standard_D1, they will not be blocked.

Hope this helps!

Hi SadiqhAhmed-MSFT,

This is exactly what we wanted. Will i be able to test it in our tenant?

@Logan Yes, you can test it and let us know if you have any questions.

Hi SadiqhAhmed-MSFT,

I created a policy based on the template given but it is not working with any of the user id's.

Example: 1234-1234 is the my username object id and 3333-3333 is the test account. I tried with both accounts but no luck.

{
    "properties": {
        "policyAssignmentId": "/subscriptions/SubscriptionID/providers/Microsoft.Authorization/policyAssignments/DenyResourceCreation",
        "policyRule": {
            "if": {
                "field": "type",
                "equals": "Microsoft.Storage/storageAccounts"
            },
            "then": {
                "effect": "deny"
            }
        },
        "resourceSelectors": [
            {
                "name": "AllowedUsers",
                "selectors": [
                    {
                        "kind": "userPrincipalId",
                        "in": ["1234-1234"]
                    },
                    {
                        "kind": "userPrincipalId",
                        "notIn": ["1111-1111", "2222-2222","3333-3333"]
                    }
                ]
            }
        ],
        "exemptionCategory": "Waiver",
        "displayName": "Deny Resource Creation-v9",
        "description": "This exemption allows specific users to create resources"
    }
}

@Logan The sample you shared attempts to combine the identity-based resource selectors in the policy rule. However, the selectors belong in the exemption object, not in the policy definition. 

So, you’ll first need to create the policy definition which blocks storage account creation, then assign it to the desired scope. Once that assignment is in place, then you’ll create an exemption for that assignment which uses selectors to specify allowed/disallowed user/object ID(s).

Also, in your selectors, it is not necessary to use both the “in” and “notIn” restrictions – this one is more restrictive and can be used by itself: "kind": "userPrincipalId", "in": ["1234-1234"]

Let me know if this makes sense. 

@SadiqhAhmed-MSFT, I was confused with your multiple screenshots and that's why added everything. If i understood correctly, I'll have to create block all users E.g group1 and create exemption for specific users. But i don't see any exemption for user-based category.

Only below are the exemptions available

@Logan Yes this [create block all users E.g group1 and create exemption for specific users] is the correct understanding. In its current private preview state, identity-based exemptions through resource selectors are not supported in portal. Can you try creating the exemption through an API call?

Hi @SadiqhAhmed-MSFT , Are you sure through API we can exempt because i was referring this article and don't see the relevant exemption

https://learn.microsoft.com/en-us/rest/api/policy/policy-exemptions/create-or-update?view=rest-policy-2022-07-01-preview&tabs=HTTP

Can you please share the correct article.

@Logan This feature is not publicly documented yet because it is in private preview.

Since this capability is just an additional supported property (resourceSelectors) in the exemption JSON payload, all you have to do is adjust the request body for the create API call. 

The screenshots I shared in the earlier post shows the JSON schema to use in the request body for the API call to create an identity-based exemption, and you can just use the existing URI (in the public document you linked) to send the create API request. 

Sorry for the confusion here! Let me know if you have further questions.

SadiqhAhmed-MSFT, Will you be able to provide any example?

@Logan YES – you should be able to create the exemption using an API request URI & request body like this (be sure to first assign the policy, then insert real values for the placeholders shown): 

PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/policyExemptions/{policyExemptionName}?api-version=2022-07-01-preview

Let me know if this works out for you.

This feature is exactly what I was looking for and it’s working as expected. Could you please let me know when it will be available for general use? Additionally, is there an RSS feed I can subscribe to so I can stay updated on its availability?

Just to give you a heads up, my company has a policy that restricts us from using any feature that is still in preview. So, I’d like to ensure we are compliant with this policy.