Custom policy using ARM template - azure

Question

I am trying to create a policy to assign multiple tags. While assigning this policy , the validation fails, if no tags or wrong tags defined in policy are assigned. However it doesn't validate the allof condition in the template, which means, if I assign any one tag, it validates and create the resource. Ideally it should check for all the eight tags mentioned. I am not clear with this policy template how to add an enforce additional tags within the single ARM Template. Below is the template
"mode": "Indexed",
"policyRule": {
"if": {
"allOf": [
{
"field": "[concat('tags[', parameters('tagName1'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName2'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName3'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName4'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName5'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName6'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName7'), ']')]",
"exists": "false"
},
{
"field": "[concat('tags[', parameters('tagName8'), ']')]",
"exists": "false"
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName1": {
"type": "String",
"metadata": {
"displayName": "Tag name1",
"description": "Name of the tag to enforce"
}
},
"tagName2": {
"type": "String",
"metadata": {
"displayName": "Tag name2",
"description": "Name of the tag to enforce"
}
},
"tagName3": {
"type": "String",
"metadata": {
"displayName": "Tag name3",
"description": "Name of the tag to enforce"
}
},
"tagName4": {
"type": "String",
"metadata": {
"displayName": "Tag name4",
"description": "Name of the tag to enforce"
}
},
"tagName5": {
"type": "String",
"metadata": {
"displayName": "Tag name5",
"description": "Name of the tag to enforce"
}
},
"tagName6": {
"type": "String",
"metadata": {
"displayName": "Tag name6",
"description": "Name of the tag to enforce"
}
},
"tagName7": {
"type": "String",
"metadata": {
"displayName": "Tag name7",
"description": "Name of the tag to enforce"
}
},
"tagName8": {
"type": "String",
"metadata": {
"displayName": "Tag name8",
"description": "Name of the tag to enforce"
}
}
}
}```
Regards,
Sajith

Answer 1

A custom policy definition allows customers to define their own rules on resources in your Azure subscriptions. It is a part of the Azure Governance and management toolbox native to Azure.
If you are not clear with the policy template about how to add and enforce additional tags within the single ARM Template then, its actually pretty straight forward. You need to add the additional tags as Rules and Parameters.
The ARM template given below will help you to achieve your desired result.
{
"mode": "all",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Resources/subscriptions/resourceGroups"
},
{
"not": {
"field": "[concat('tags[',parameters('tagName1'), ']')]",
"exists": "true"
}
},
{
"not": {
"field": "[concat('tags[',parameters('tagName2'), ']')]",
"exists": "true"
}
},
{
"not": {
"field": "[concat('tags[',parameters('tagName3'), ']')]",
"exists": "true"
}
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName1": {
"type": "String",
"metadata": {
"displayName": "Tag name1",
"description": "Name of the tag to enforce"
}
},
"tagName2": {
"type": "String",
"metadata": {
"displayName": "Tag name2",
"description": "Name of the tag to enforce"
}
},
"tagName3": {
"type": "String",
"metadata": {
"displayName": "Tag name3",
"description": "Name of the tag to enforce"
}
}
...
...
The next time someone deploys a resource group without the required tags in the subscription this policy is assigned to it will fail.
I would suggest to read these Azure Policy pattern: tags Microsoft document and Require Many Tags on Resource Groups via Azure Policy document for more information.