How to enforce that Delete Retention is configured on Azure Storage by using a deployIfNotExists policy?

Question

I would like to create a policy that automatically applies a delete retention policy of 14 days to every new storage created. I think that this is possible by using a deployIfNotExists policy, but I was not able to find a sample JSON or anything on the Internet.

score 4 · Accepted Answer · answered Nov 24 '20 at 08:27

I spoke with Microsoft, and they uploaded an example that worked fine. This would be the json extracted from Community-Policy:

{
    "properties": {
        "displayName": "Deploy Soft-Delete for Blobs",
        "mode": "All",
        "description": "This policy enables soft-delete for blobs.",
        "parameters": {
            "retentionInDays": {
                "type": "Integer",
                "minValue": 1,
                "maxValue": 365,
                "defaultValue": 7,
                "metadata": {
                    "displayName": "Retention in days",
                    "description": "This defines how long the deleted object should be retained for. Allowed values are 1 to 365."
                }
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Storage/storageAccounts"
                    },
                    {
                        "field": "kind",
                        "in": [
                            "Storage",
                            "StorageV2",
                            "BlobStorage",
                            "BlockBlobStorage"
                        ]
                    }
                ]
            },
            "then": {
                "effect": "DeployIfNotExists",
                "details": {
                    "type": "Microsoft.Storage/storageAccounts/blobServices",
                    "existenceCondition": {
                        "field": "Microsoft.Storage/storageAccounts/blobServices/default.deleteRetentionPolicy.enabled",
                        "equals": true
                    },
                    "roleDefinitionIds": [
                        "/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
                    ],
                    "deployment": {
                        "properties": {
                            "mode": "incremental",
                            "template": {
                                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "storageAccountName": {
                                        "type": "string"
                                    },
                                    "retentionInDays": {
                                        "type": "int"
                                    }
                                },
                                "variables": {},
                                "resources": [
                                    {
                                        "name": "[concat(parameters('storageAccountName'), '/default')]",
                                        "type": "Microsoft.Storage/storageAccounts/blobServices",
                                        "apiVersion": "2019-06-01",
                                        "properties": {
                                            "deleteRetentionPolicy": {
                                                "enabled": true,
                                                "days": "[parameters('retentionInDays')]"
                                            }
                                        }
                                    }
                                ],
                                "outputs": {}
                            },
                            "parameters": {
                                "storageAccountName": {
                                    "value": "[field('name')]"
                                },
                                "retentionInDays": {
                                    "value": "[parameters('retentionInDays')]"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

AFAIK this will not apply automatically to new resources, but you would need to run a remediation task to fix them, correct? — csanchez, Dec 14 '20 at 19:27
the remediation task will run automatically for new and old resources. — Rafael Colucci, Jan 20 '21 at 09:31
"During an evaluation cycle, policy definitions with a DeployIfNotExists effect that match resources are marked as non-compliant, but no action is taken on that resource. Existing non-compliant resources can be remediated with a remediation task." https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#deployifnotexists-evaluation — csanchez, Jan 20 '21 at 10:43

score 1 · Answer 2 · answered Nov 23 '20 at 07:18

You can try the code below(by the way, no time to test it at my side):

{
   "mode":"All",
   "policyRule":{
      "if":{
         "field":"type",
         "equals":"Microsoft.Storage/storageAccounts"
      },
      "then":{
         "effect":"deployIfNotExists",
         "details":{
            "type":"Microsoft.Storage/storageAccounts",
            "roleDefinitionIds":[
               "xxx"
            ],
            "deployment":{
               "properties":{
                  "mode":"incremental",
                  "template":{
                     "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                     "contentVersion":"1.0.0.0",
                     "parameters":{
                        "storageAccountName":{
                           "type":"String",
                           "metadata":{
                              "description":"storageAccountName"
                           }
                        },
                        "location":{
                           "type":"String",
                           "metadata":{
                              "description":"location"
                           }
                        }
                     },
                     "variables":{
                        
                     },
                     "resources":[
                        {
                           "type":"Microsoft.Storage/storageAccounts",
                           "apiVersion":"2019-06-01",
                           "name":"[parameters('storageAccountName')]",
                           "location":"[parameters('location')]",
                           "resources":[
                              {
                                 "name":"default",
                                 "type":"Microsoft.Storage/storageAccounts/managementPolicies",
                                 "apiVersion":"2019-06-01",
                                 "properties":{
                                    "policy":{
                                       "rules":[
                                          "xxx"
                                       ]
                                    }
                                 }
                              }
                           ]
                        }
                     ],
                     "outputs":{
                        
                     }
                  },
                  "parameters":{
                     "storageAccountName":{
                        "value":"[field('Name')]"
                     },
                     "location":{
                        "value":"[field('location')]"
                     }
                  }
               }
            }
         }
      }
   },
   "parameters":{
      
   }
}

Here is the details of the json format of Life cycle management.

@twinklehema, it seems impossible as per [this feedback](https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/38762671-azure-policy-to-deny-storage-account-creation-when). — Ivan Glasenberg, Dec 22 '20 at 06:32

How to enforce that Delete Retention is configured on Azure Storage by using a deployIfNotExists policy?

2 Answers2