1. Docs
  2. Reference
  3. API
  4. Azure
  5. policy
  6. Assignment

Assignment

Configures the specified Policy Definition at the specified Scope. Also, Policy Set Definitions are supported.

Example Usage

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var exampleDefinition = new Azure.Policy.Definition("exampleDefinition", new Azure.Policy.DefinitionArgs
        {
            PolicyType = "Custom",
            Mode = "All",
            DisplayName = "my-policy-definition",
            PolicyRule = @"   {
    ""if"": {
      ""not"": {
        ""field"": ""location"",
        ""in"": ""[parameters('allowedLocations')]""
      }
    },
    ""then"": {
      ""effect"": ""audit""
    }
  }
",
            Parameters = @"   {
    ""allowedLocations"": {
      ""type"": ""Array"",
      ""metadata"": {
        ""description"": ""The list of allowed locations for resources."",
        ""displayName"": ""Allowed locations"",
        ""strongType"": ""location""
      }
    }
  }
",
        });
        var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
        {
            Location = "West Europe",
        });
        var exampleAssignment = new Azure.Policy.Assignment("exampleAssignment", new Azure.Policy.AssignmentArgs
        {
            Scope = exampleResourceGroup.Id,
            PolicyDefinitionId = exampleDefinition.Id,
            Description = "Policy Assignment created via an Acceptance Test",
            DisplayName = "My Example Policy Assignment",
            Parameters = @"{
  ""allowedLocations"": {
    ""value"": [ ""West Europe"" ]
  }
}
",
        });
    }

}

package main

import (
    "fmt"

    "github.com/pulumi/pulumi-azure/sdk/v3/go/azure/core"
    "github.com/pulumi/pulumi-azure/sdk/v3/go/azure/policy"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        exampleDefinition, err := policy.NewDefinition(ctx, "exampleDefinition", &policy.DefinitionArgs{
            PolicyType:  pulumi.String("Custom"),
            Mode:        pulumi.String("All"),
            DisplayName: pulumi.String("my-policy-definition"),
            PolicyRule: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v", "  {\n", "    \"if\": {\n", "      \"not\": {\n", "        \"field\": \"location\",\n", "        \"in\": \"[parameters('allowedLocations')]\"\n", "      }\n", "    },\n", "    \"then\": {\n", "      \"effect\": \"audit\"\n", "    }\n", "  }\n")),
            Parameters: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v", "    {\n", "    \"allowedLocations\": {\n", "      \"type\": \"Array\",\n", "      \"metadata\": {\n", "        \"description\": \"The list of allowed locations for resources.\",\n", "        \"displayName\": \"Allowed locations\",\n", "        \"strongType\": \"location\"\n", "      }\n", "    }\n", "  }\n")),
        })
        if err != nil {
            return err
        }
        exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
            Location: pulumi.String("West Europe"),
        })
        if err != nil {
            return err
        }
        _, err = policy.NewAssignment(ctx, "exampleAssignment", &policy.AssignmentArgs{
            Scope:              exampleResourceGroup.ID(),
            PolicyDefinitionId: exampleDefinition.ID(),
            Description:        pulumi.String("Policy Assignment created via an Acceptance Test"),
            DisplayName:        pulumi.String("My Example Policy Assignment"),
            Parameters:         pulumi.String(fmt.Sprintf("%v%v%v%v%v", "{\n", "  \"allowedLocations\": {\n", "    \"value\": [ \"West Europe\" ]\n", "  }\n", "}\n")),
        })
        if err != nil {
            return err
        }
        return nil
    })
}
import pulumi
import pulumi_azure as azure

example_definition = azure.policy.Definition("exampleDefinition",
    policy_type="Custom",
    mode="All",
    display_name="my-policy-definition",
    policy_rule="""  {
    "if": {
      "not": {
        "field": "location",
        "in": "[parameters('allowedLocations')]"
      }
    },
    "then": {
      "effect": "audit"
    }
  }
""",
    parameters="""   {
    "allowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }
""")
example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
example_assignment = azure.policy.Assignment("exampleAssignment",
    scope=example_resource_group.id,
    policy_definition_id=example_definition.id,
    description="Policy Assignment created via an Acceptance Test",
    display_name="My Example Policy Assignment",
    parameters="""{
  "allowedLocations": {
    "value": [ "West Europe" ]
  }
}
""")
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const exampleDefinition = new azure.policy.Definition("exampleDefinition", {
    policyType: "Custom",
    mode: "All",
    displayName: "my-policy-definition",
    policyRule: `   {
    "if": {
      "not": {
        "field": "location",
        "in": "[parameters('allowedLocations')]"
      }
    },
    "then": {
      "effect": "audit"
    }
  }
`,
    parameters: `   {
    "allowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }
`,
});
const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
const exampleAssignment = new azure.policy.Assignment("exampleAssignment", {
    scope: exampleResourceGroup.id,
    policyDefinitionId: exampleDefinition.id,
    description: "Policy Assignment created via an Acceptance Test",
    displayName: "My Example Policy Assignment",
    parameters: `{
  "allowedLocations": {
    "value": [ "West Europe" ]
  }
}
`,
});

Create a Assignment Resource

new Assignment(name: string, args: AssignmentArgs, opts?: CustomResourceOptions);
def Assignment(resource_name, opts=None, description=None, display_name=None, enforcement_mode=None, identity=None, location=None, name=None, not_scopes=None, parameters=None, policy_definition_id=None, scope=None, __props__=None);
func NewAssignment(ctx *Context, name string, args AssignmentArgs, opts ...ResourceOption) (*Assignment, error)
public Assignment(string name, AssignmentArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args AssignmentArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
opts ResourceOptions
A bag of options that control this resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args AssignmentArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args AssignmentArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

Assignment Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The Assignment resource accepts the following input properties:

PolicyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

Scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

Description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

DisplayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

EnforcementMode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

Identity AssignmentIdentityArgs

An identity block.

Location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

Name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

NotScopes List<string>

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

Parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

PolicyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

Scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

Description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

DisplayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

EnforcementMode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

Identity AssignmentIdentity

An identity block.

Location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

Name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

NotScopes []string

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

Parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

policyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

displayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

enforcementMode boolean

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

identity AssignmentIdentity

An identity block.

location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

notScopes string[]

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

policy_definition_id str

The ID of the Policy Definition to be applied at the specified Scope.

scope str

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

description str

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

display_name str

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

enforcement_mode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

identity Dict[AssignmentIdentity]

An identity block.

location str

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

name str

The name of the Policy Assignment. Changing this forces a new resource to be created.

not_scopes List[str]

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

parameters str

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

Outputs

All input properties are implicitly available as output properties. Additionally, the Assignment resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing Assignment Resource

Get an existing Assignment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AssignmentState, opts?: CustomResourceOptions): Assignment
static get(resource_name, id, opts=None, description=None, display_name=None, enforcement_mode=None, identity=None, location=None, name=None, not_scopes=None, parameters=None, policy_definition_id=None, scope=None, __props__=None);
func GetAssignment(ctx *Context, name string, id IDInput, state *AssignmentState, opts ...ResourceOption) (*Assignment, error)
public static Assignment Get(string name, Input<string> id, AssignmentState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

Description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

DisplayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

EnforcementMode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

Identity AssignmentIdentityArgs

An identity block.

Location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

Name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

NotScopes List<string>

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

Parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

PolicyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

Scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

Description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

DisplayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

EnforcementMode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

Identity AssignmentIdentity

An identity block.

Location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

Name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

NotScopes []string

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

Parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

PolicyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

Scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

description string

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

displayName string

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

enforcementMode boolean

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

identity AssignmentIdentity

An identity block.

location string

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

name string

The name of the Policy Assignment. Changing this forces a new resource to be created.

notScopes string[]

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

parameters string

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

policyDefinitionId string

The ID of the Policy Definition to be applied at the specified Scope.

scope string

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

description str

A description to use for this Policy Assignment. Changing this forces a new resource to be created.

display_name str

A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.

enforcement_mode bool

Can be set to ‘true’ or ‘false’ to control whether the assignment is enforced (true) or not (false). Default is ‘true’.

identity Dict[AssignmentIdentity]

An identity block.

location str

The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.

name str

The name of the Policy Assignment. Changing this forces a new resource to be created.

not_scopes List[str]

A list of the Policy Assignment’s excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).

parameters str

Parameters for the policy definition. This field is a JSON object that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

policy_definition_id str

The ID of the Policy Definition to be applied at the specified Scope.

scope str

The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

Supporting Types

AssignmentIdentity

See the input and output API doc for this type.

See the input and output API doc for this type.

See the input and output API doc for this type.

PrincipalId string

The Principal ID of this Policy Assignment if type is SystemAssigned.

TenantId string

The Tenant ID of this Policy Assignment if type is SystemAssigned.

Type string

The Managed Service Identity Type of this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you), or None (no use of a Managed Service Identity).

PrincipalId string

The Principal ID of this Policy Assignment if type is SystemAssigned.

TenantId string

The Tenant ID of this Policy Assignment if type is SystemAssigned.

Type string

The Managed Service Identity Type of this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you), or None (no use of a Managed Service Identity).

principalId string

The Principal ID of this Policy Assignment if type is SystemAssigned.

tenantId string

The Tenant ID of this Policy Assignment if type is SystemAssigned.

type string

The Managed Service Identity Type of this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you), or None (no use of a Managed Service Identity).

principal_id str

The Principal ID of this Policy Assignment if type is SystemAssigned.

tenant_id str

The Tenant ID of this Policy Assignment if type is SystemAssigned.

type str

The Managed Service Identity Type of this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you), or None (no use of a Managed Service Identity).

Package Details

Repository
https://github.com/pulumi/pulumi-azure
License
Apache-2.0
Notes
This Pulumi package is based on the azurerm Terraform Provider.