Docs
PackagesWe recommend using Azure Native.
azure.policy.Definition
Explore with Pulumi AI
Manages a policy rule definition on a management group or your provider subscription.
Policy definitions do not take effect until they are assigned to a scope using a Policy Assignment.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var policy = new Azure.Policy.Definition("policy", new()
{
DisplayName = "acceptance test policy definition",
Metadata = @" {
""category"": ""General""
}
",
Mode = "Indexed",
Parameters = @" {
""allowedLocations"": {
""type"": ""Array"",
""metadata"": {
""description"": ""The list of allowed locations for resources."",
""displayName"": ""Allowed locations"",
""strongType"": ""location""
}
}
}
",
PolicyRule = @" {
""if"": {
""not"": {
""field"": ""location"",
""in"": ""[parameters('allowedLocations')]""
}
},
""then"": {
""effect"": ""audit""
}
}
",
PolicyType = "Custom",
});
});
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/policy"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := policy.NewDefinition(ctx, "policy", &policy.DefinitionArgs{
DisplayName: pulumi.String("acceptance test policy definition"),
Metadata: pulumi.String(" {\n \"category\": \"General\"\n }\n\n\n"),
Mode: pulumi.String("Indexed"),
Parameters: pulumi.String(` {
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
`),
PolicyRule: pulumi.String(` {
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
`),
PolicyType: pulumi.String("Custom"),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.policy.Definition;
import com.pulumi.azure.policy.DefinitionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var policy = new Definition("policy", DefinitionArgs.builder()
.displayName("acceptance test policy definition")
.metadata("""
{
"category": "General"
}
""")
.mode("Indexed")
.parameters("""
{
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
""")
.policyRule("""
{
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
""")
.policyType("Custom")
.build());
}
}
import pulumi
import pulumi_azure as azure
policy = azure.policy.Definition("policy",
display_name="acceptance test policy definition",
metadata=""" {
"category": "General"
}
""",
mode="Indexed",
parameters=""" {
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
""",
policy_rule=""" {
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
""",
policy_type="Custom")
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const policy = new azure.policy.Definition("policy", {
displayName: "acceptance test policy definition",
metadata: ` {
"category": "General"
}
`,
mode: "Indexed",
parameters: ` {
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
`,
policyRule: ` {
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
`,
policyType: "Custom",
});
resources:
policy:
type: azure:policy:Definition
properties:
displayName: acceptance test policy definition
metadata: |2+
{
"category": "General"
}
mode: Indexed
parameters: |2+
{
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
policyRule: |2+
{
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
policyType: Custom
Create Definition Resource
new Definition(name: string, args: DefinitionArgs, opts?: CustomResourceOptions);@overload
def Definition(resource_name: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
management_group_id: Optional[str] = None,
metadata: Optional[str] = None,
mode: Optional[str] = None,
name: Optional[str] = None,
parameters: Optional[str] = None,
policy_rule: Optional[str] = None,
policy_type: Optional[str] = None)
@overload
def Definition(resource_name: str,
args: DefinitionArgs,
opts: Optional[ResourceOptions] = None)func NewDefinition(ctx *Context, name string, args DefinitionArgs, opts ...ResourceOption) (*Definition, error)public Definition(string name, DefinitionArgs args, CustomResourceOptions? opts = null)
public Definition(String name, DefinitionArgs args)
public Definition(String name, DefinitionArgs args, CustomResourceOptions options)
type: azure:policy:Definition
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args DefinitionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args DefinitionArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args DefinitionArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args DefinitionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args DefinitionArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Definition Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The Definition resource accepts the following input properties:
- Display
Name string The display name of the policy definition.
- Mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- Policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- Description string
The description of the policy definition.
- Management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- Metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- Name string
The name of the policy definition. Changing this forces a new resource to be created.
- Parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- Policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- Display
Name string The display name of the policy definition.
- Mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- Policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- Description string
The description of the policy definition.
- Management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- Metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- Name string
The name of the policy definition. Changing this forces a new resource to be created.
- Parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- Policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- display
Name String The display name of the policy definition.
- mode String
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- policy
Type String The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- description String
The description of the policy definition.
- management
Group StringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata String
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- name String
The name of the policy definition. Changing this forces a new resource to be created.
- parameters String
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule String The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- display
Name string The display name of the policy definition.
- mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- description string
The description of the policy definition.
- management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- name string
The name of the policy definition. Changing this forces a new resource to be created.
- parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- display_
name str The display name of the policy definition.
- mode str
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- policy_
type str The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- description str
The description of the policy definition.
- management_
group_ strid The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata str
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- name str
The name of the policy definition. Changing this forces a new resource to be created.
- parameters str
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy_
rule str The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- display
Name String The display name of the policy definition.
- mode String
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- policy
Type String The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- description String
The description of the policy definition.
- management
Group StringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata String
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- name String
The name of the policy definition. Changing this forces a new resource to be created.
- parameters String
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule String The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
Outputs
All input properties are implicitly available as output properties. Additionally, the Definition resource produces the following output properties:
- Id string
The provider-assigned unique ID for this managed resource.
- Role
Definition List<string>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- Id string
The provider-assigned unique ID for this managed resource.
- Role
Definition []stringIds A list of role definition id extracted from
policy_rulerequired for remediation.
- id String
The provider-assigned unique ID for this managed resource.
- role
Definition List<String>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- id string
The provider-assigned unique ID for this managed resource.
- role
Definition string[]Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- id str
The provider-assigned unique ID for this managed resource.
- role_
definition_ Sequence[str]ids A list of role definition id extracted from
policy_rulerequired for remediation.
- id String
The provider-assigned unique ID for this managed resource.
- role
Definition List<String>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
Look up Existing Definition Resource
Get an existing Definition resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: DefinitionState, opts?: CustomResourceOptions): Definition@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
management_group_id: Optional[str] = None,
metadata: Optional[str] = None,
mode: Optional[str] = None,
name: Optional[str] = None,
parameters: Optional[str] = None,
policy_rule: Optional[str] = None,
policy_type: Optional[str] = None,
role_definition_ids: Optional[Sequence[str]] = None) -> Definitionfunc GetDefinition(ctx *Context, name string, id IDInput, state *DefinitionState, opts ...ResourceOption) (*Definition, error)public static Definition Get(string name, Input<string> id, DefinitionState? state, CustomResourceOptions? opts = null)public static Definition get(String name, Output<String> id, DefinitionState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Description string
The description of the policy definition.
- Display
Name string The display name of the policy definition.
- Management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- Metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- Mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- Name string
The name of the policy definition. Changing this forces a new resource to be created.
- Parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- Policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- Policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- Role
Definition List<string>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- Description string
The description of the policy definition.
- Display
Name string The display name of the policy definition.
- Management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- Metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- Mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- Name string
The name of the policy definition. Changing this forces a new resource to be created.
- Parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- Policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- Policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- Role
Definition []stringIds A list of role definition id extracted from
policy_rulerequired for remediation.
- description String
The description of the policy definition.
- display
Name String The display name of the policy definition.
- management
Group StringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata String
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- mode String
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- name String
The name of the policy definition. Changing this forces a new resource to be created.
- parameters String
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule String The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- policy
Type String The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- role
Definition List<String>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- description string
The description of the policy definition.
- display
Name string The display name of the policy definition.
- management
Group stringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata string
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- mode string
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- name string
The name of the policy definition. Changing this forces a new resource to be created.
- parameters string
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule string The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- policy
Type string The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- role
Definition string[]Ids A list of role definition id extracted from
policy_rulerequired for remediation.
- description str
The description of the policy definition.
- display_
name str The display name of the policy definition.
- management_
group_ strid The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata str
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- mode str
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- name str
The name of the policy definition. Changing this forces a new resource to be created.
- parameters str
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy_
rule str The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- policy_
type str The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- role_
definition_ Sequence[str]ids A list of role definition id extracted from
policy_rulerequired for remediation.
- description String
The description of the policy definition.
- display
Name String The display name of the policy definition.
- management
Group StringId The id of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
- metadata String
The metadata for the policy definition. This is a JSON string representing additional metadata that should be stored with the policy definition.
- mode String
The policy resource manager mode that allows you to specify which resource types will be evaluated. Possible values are
All,Indexed,Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data.Note: Other resource provider modes only support built-in policy definitions but may later become available in custom definitions, these include;
Microsoft.ContainerService.Data,Microsoft.CustomerLockbox.Data,Microsoft.DataCatalog.Data,Microsoft.KeyVault.Data,Microsoft.Kubernetes.Data,Microsoft.MachineLearningServices.Data,Microsoft.Network.DataandMicrosoft.Synapse.Data. See here for more details.- name String
The name of the policy definition. Changing this forces a new resource to be created.
- parameters String
Parameters for the policy definition. This field is a JSON string that allows you to parameterize your policy definition.
- policy
Rule String The policy rule for the policy definition. This is a JSON string representing the rule that contains an if and a then block.
- policy
Type String The policy type. Possible values are
BuiltIn,Custom,NotSpecifiedandStatic. Changing this forces a new resource to be created.- role
Definition List<String>Ids A list of role definition id extracted from
policy_rulerequired for remediation.
Import
Policy Definitions can be imported using the policy name, e.g.
$ pulumi import azure:policy/definition:Definition examplePolicy /subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Authorization/policyDefinitions/<POLICY_NAME>
or
$ pulumi import azure:policy/definition:Definition examplePolicy /providers/Microsoft.Management/managementgroups/<MANGAGEMENT_GROUP_ID>/providers/Microsoft.Authorization/policyDefinitions/<POLICY_NAME>
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
azurermTerraform Provider.