Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address issues with R/o aliases #1388

Merged
merged 4 commits into from
Oct 4, 2024
+35 −0
Merged

Address issues with R/o aliases #1388

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fee9805
Address issues with R/o aliases
kenieva Oct 2, 2024
3c63631
address comments and shown example
kenieva Oct 2, 2024
1295474
Added full list of readonly aliases
kenieva Oct 3, 2024
caba722
Update README.md
kenieva Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,4 +310,39 @@ Currently Azure Policy supports only alphanumeric characters for property and al
- `redisConfiguration.preferred-data-archive-auth-method`
- `redisConfiguration.preferred-data-persistence-auth-method`

### Read only aliases

In rare instances, aliases for read-only properties have be generated (request for R/O are not supported at this time). These aliases are strictly meant for auditing purposes, since the read-only nature does not allow for modification post resource/configuration deployment. If a policy with a modify or DINE effect targets this alias, the compliance results will show non-compliance. However, when remediated the read-only properties are not evaluated. This causes the resource to evaluate as compliant and not remediate. In most cases, if remediation is manually triggered, the system is not allowed to alter the read-only property.

Some examples of read-only aliases:
- `Microsoft.Authorization/roleAssignmentScheduleInstances/*`
- `Microsoft.BotService/botServices/networkSecurityPerimeterConfigurations/*`
- `Microsoft.Cache/Redis/privateEndpointConnections[*]`
- `Microsoft.Cache/Redis/privateEndpointConnections[*].privateLinkServiceConnectionState.status`
- `Microsoft.Cache/Redis/privateEndpointConnections[*].provisioningState`
- `Microsoft.Compute/virtualMachines/provisioningState`
- `Microsoft.DocumentDB/databaseAccounts/networkSecurityPerimeterConfigurations/networkSecurityPerimeter.id`
- `Microsoft.DocumentDB/databaseAccounts/networkSecurityPerimeterConfigurations/profile.name`
- `Microsoft.DocumentDB/databaseAccounts/networkSecurityPerimeterConfigurations/resourceAssociation.accessMode`
- `Microsoft.EventHub/namespaces/networkSecurityPerimeterConfigurations/networkSecurityPerimeter.id`
- `Microsoft.EventHub/namespaces/networkSecurityPerimeterConfigurations/resourceAssociation.accessMode`
- `Microsoft.EventHub/namespaces/networkSecurityPerimeterConfigurations/profile.name`
- `Microsoft.KeyVault/vaults/networkSecurityPerimeterConfigurations/networkSecurityPerimeter.id`
- `Microsoft.KeyVault/vaults/networkSecurityPerimeterConfigurations/resourceAssociation.accessMode`
- `Microsoft.KeyVault/vaults/networkSecurityPerimeterConfigurations/profile.name`
- `Microsoft.Sql/servers/networkSecurityPerimeterConfigurations/networkSecurityPerimeter.id`
- `Microsoft.Sql/servers/networkSecurityPerimeterConfigurations/resourceAssociation.accessMode`
- `Microsoft.Sql/servers/networkSecurityPerimeterConfigurations/profile.name`
- `Microsoft.Storage/storageAccounts/primaryEndpoints`
- `Microsoft.Storage/storageAccounts/primaryEndpoints.web`
- `Microsoft.Storage/storageAccounts/primaryEndpoints.blob`
- `Microsoft.Storage/storageAccounts/primaryEndpoints.queue`
- `Microsoft.Storage/storageAccounts/primaryEndpoints.table`
- `Microsoft.Storage/storageAccounts/primaryEndpoints.file`
- `Microsoft.Storage/storageAccounts/networkSecurityPerimeterConfigurations/networkSecurityPerimeter.id`
- `Microsoft.Storage/storageAccounts/networkSecurityPerimeterConfigurations/resourceAssociation.accessMode`
- `Microsoft.Storage/storageAccounts/networkSecurityPerimeterConfigurations/profile.name`

kenieva marked this conversation as resolved.
Show resolved Hide resolved


*This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.*