Definition

Manages a policy rule definition on a management group or your provider subscription.

Policy definitions do not take effect until they are assigned to a scope using a Policy Assignment.

Example Usage

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var policy = new Azure.Policy.Definition("policy", new Azure.Policy.DefinitionArgs
        {
            DisplayName = "acceptance test policy definition",
            Metadata = @"    {
    ""category"": ""General""
    }
  

",
            Mode = "Indexed",
            Parameters = @"   {
    ""allowedLocations"": {
      ""type"": ""Array"",
      ""metadata"": {
        ""description"": ""The list of allowed locations for resources."",
        ""displayName"": ""Allowed locations"",
        ""strongType"": ""location""
      }
    }
  }

",
            PolicyRule = @"   {
    ""if"": {
      ""not"": {
        ""field"": ""location"",
        ""in"": ""[parameters('allowedLocations')]""
      }
    },
    ""then"": {
      ""effect"": ""audit""
    }
  }

",
            PolicyType = "Custom",
        });
    }

}

package main

import (
    "fmt"

    "github.com/pulumi/pulumi-azure/sdk/v3/go/azure/policy"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err = policy.NewDefinition(ctx, "policy", &policy.DefinitionArgs{
            DisplayName: pulumi.String("acceptance test policy definition"),
            Metadata:    pulumi.String(fmt.Sprintf("%v%v%v%v%v", "    {\n", "    \"category\": \"General\"\n", "    }\n", "  \n", "\n")),
            Mode:        pulumi.String("Indexed"),
            Parameters: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v", "  {\n", "    \"allowedLocations\": {\n", "      \"type\": \"Array\",\n", "      \"metadata\": {\n", "        \"description\": \"The list of allowed locations for resources.\",\n", "        \"displayName\": \"Allowed locations\",\n", "        \"strongType\": \"location\"\n", "      }\n", "    }\n", "  }\n", "\n")),
            PolicyRule: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v", "    {\n", "    \"if\": {\n", "      \"not\": {\n", "        \"field\": \"location\",\n", "        \"in\": \"[parameters('allowedLocations')]\"\n", "      }\n", "    },\n", "    \"then\": {\n", "      \"effect\": \"audit\"\n", "    }\n", "  }\n", "\n")),
            PolicyType: pulumi.String("Custom"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_azure as azure

policy = azure.policy.Definition("policy",
    display_name="acceptance test policy definition",
    metadata="""    {
    "category": "General"
    }
  

""",
    mode="Indexed",
    parameters="""   {
    "allowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }

""",
    policy_rule="""  {
    "if": {
      "not": {
        "field": "location",
        "in": "[parameters('allowedLocations')]"
      }
    },
    "then": {
      "effect": "audit"
    }
  }

""",
    policy_type="Custom")

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const policy = new azure.policy.Definition("policy", {
    displayName: "acceptance test policy definition",
    metadata: `    {
    "category": "General"
    }
  
`,
    mode: "Indexed",
    parameters: `   {
    "allowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }
`,
    policyRule: `   {
    "if": {
      "not": {
        "field": "location",
        "in": "[parameters('allowedLocations')]"
      }
    },
    "then": {
      "effect": "audit"
    }
  }
`,
    policyType: "Custom",
});

Create a Definition Resource

new Definition(name: string, args: DefinitionArgs, opts?: CustomResourceOptions);

def Definition(resource_name, opts=None, description=None, display_name=None, management_group_id=None, management_group_name=None, metadata=None, mode=None, name=None, parameters=None, policy_rule=None, policy_type=None, __props__=None);

func NewDefinition(ctx *Context, name string, args DefinitionArgs, opts ...ResourceOption) (*Definition, error)

public Definition(string name, DefinitionArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args DefinitionArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args DefinitionArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args DefinitionArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

Definition Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The Definition resource accepts the following input properties:

DisplayName string: The display name of the policy definition.
Mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
PolicyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.
Description string: The description of the policy definition.
ManagementGroupId string: Deprecated: Deprecated in favour of management_group_name
ManagementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
Metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
Name string: The name of the policy definition. Changing this forces a new resource to be created.
Parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
PolicyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.

DisplayName string: The display name of the policy definition.
Mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
PolicyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.
Description string: The description of the policy definition.
ManagementGroupId string: Deprecated: Deprecated in favour of management_group_name
ManagementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
Metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
Name string: The name of the policy definition. Changing this forces a new resource to be created.
Parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
PolicyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.

displayName string: The display name of the policy definition.
mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
policyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.
description string: The description of the policy definition.
managementGroupId string: Deprecated: Deprecated in favour of management_group_name
managementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
name string: The name of the policy definition. Changing this forces a new resource to be created.
parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
policyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.

display_name str: The display name of the policy definition.
mode str: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
policy_type str: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.
description str: The description of the policy definition.
management_group_id str: Deprecated: Deprecated in favour of management_group_name
management_group_name str: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
metadata str: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
name str: The name of the policy definition. Changing this forces a new resource to be created.
parameters str: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
policy_rule str: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.

Outputs

All input properties are implicitly available as output properties. Additionally, the Definition resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing Definition Resource

Get an existing Definition resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: DefinitionState, opts?: CustomResourceOptions): Definition

static get(resource_name, id, opts=None, description=None, display_name=None, management_group_id=None, management_group_name=None, metadata=None, mode=None, name=None, parameters=None, policy_rule=None, policy_type=None, __props__=None);

func GetDefinition(ctx *Context, name string, id IDInput, state *DefinitionState, opts ...ResourceOption) (*Definition, error)

public static Definition Get(string name, Input<string> id, DefinitionState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Description string: The description of the policy definition.
DisplayName string: The display name of the policy definition.
ManagementGroupId string: Deprecated: Deprecated in favour of management_group_name
ManagementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
Metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
Mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
Name string: The name of the policy definition. Changing this forces a new resource to be created.
Parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
PolicyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.
PolicyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.

Description string: The description of the policy definition.
DisplayName string: The display name of the policy definition.
ManagementGroupId string: Deprecated: Deprecated in favour of management_group_name
ManagementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
Metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
Mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
Name string: The name of the policy definition. Changing this forces a new resource to be created.
Parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
PolicyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.
PolicyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.

description string: The description of the policy definition.
displayName string: The display name of the policy definition.
managementGroupId string: Deprecated: Deprecated in favour of management_group_name
managementGroupName string: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
metadata string: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
mode string: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
name string: The name of the policy definition. Changing this forces a new resource to be created.
parameters string: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
policyRule string: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.
policyType string: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.

description str: The description of the policy definition.
display_name str: The display name of the policy definition.
management_group_id str: Deprecated: Deprecated in favour of management_group_name
management_group_name str: The name of the Management Group where this policy should be defined. Changing this forces a new resource to be created.
metadata str: The metadata for the policy definition. This is a json object representing additional metadata that should be stored with the policy definition.
mode str: The policy mode that allows you to specify which resource types will be evaluated. The value can be “All”, “Indexed” or “NotSpecified”. Changing this resource forces a new resource to be created.
name str: The name of the policy definition. Changing this forces a new resource to be created.
parameters str: Parameters for the policy definition. This field is a json object that allows you to parameterize your policy definition.
policy_rule str: The policy rule for the policy definition. This is a json object representing the rule that contains an if and a then block.
policy_type str: The policy type. Possible values are BuiltIn, Custom and NotSpecified. Changing this forces a new resource to be created.

Package Details

Repository: https://github.com/pulumi/pulumi-azure
License: Apache-2.0
Notes: This Pulumi package is based on the azurerm Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud