Skip to content

Commit 3b91e59

Browse files
SpringstoneSpringstone
committed
Remove duplicate assignment and portal option for Azure Policy Add-on at Landing Zones scope
1 parent a15b193 commit 3b91e59

File tree

4 files changed

+4
-163
lines changed

4 files changed

+4
-163
lines changed

‎docs/wiki/Whats-new.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ This article will be updated as and when changes are made to the above and anyth
4646

4747
Here's what's changed in Enterprise Scale/Azure Landing Zones:
4848

49+
### 🔃 Policy Refresh Q1 FY25
50+
51+
- Removed duplicate assignment and portal option of [Deploy Azure Policy Add-on to Azure Kubernetes Service clusters](https://www.azadvertizer.net/azpolicyadvertizer/a8eff44f-8c92-45c3-a3fb-9880802d67a7.html) at Landing Zones scope, as this policy is assigned in the initiative [Deploy Microsoft Defender for Cloud configuration](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config_20240319.html) at Intermediate Root scope.
52+
4953
### June 2024
5054

5155
#### Documentation

‎eslzArm/eslz-portal.json

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -831,26 +831,6 @@
831831
]
832832
}
833833
},
834-
{
835-
"name": "enableAscForDns",
836-
"type": "Microsoft.Common.OptionsGroup",
837-
"label": "Enable Microsoft Defender for Cloud for DNS",
838-
"defaultValue": "Yes (recommended)",
839-
"toolTip": "If 'Yes' is selected, Microsoft Defender for Cloud will be enabled for DNS.<br>Uses the custom initiative <a href=\"https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config.html\">Deploy Microsoft Defender for Cloud configuration</a>.",
840-
"visible": "[and(equals(steps('management').enableAsc,'Yes'), or(equals(steps('basics').cloudEnvironment.selection, 'AzureCloud'), equals(steps('basics').cloudEnvironment.selection, 'AzureUSGovernment')))]",
841-
"constraints": {
842-
"allowedValues": [
843-
{
844-
"label": "Yes (recommended)",
845-
"value": "DeployIfNotExists"
846-
},
847-
{
848-
"label": "No",
849-
"value": "Disabled"
850-
}
851-
]
852-
}
853-
},
854834
{
855835
"name": "enableAscForContainers",
856836
"type": "Microsoft.Common.OptionsGroup",
@@ -4374,30 +4354,6 @@
43744354
},
43754355
"visible": "[equals(steps('management').enableLogAnalytics,'Yes')]"
43764356
},
4377-
{
4378-
"name": "enableAksPolicy",
4379-
"type": "Microsoft.Common.OptionsGroup",
4380-
"label": "Enable Kubernetes (AKS) for Azure Policy",
4381-
"defaultValue": "Yes (recommended)",
4382-
"toolTip": "If 'Yes' is selected the Azure Policy Add-on to manage and report on the compliance state of your Azure Kubernetes Service (AKS) clusters will be enabled.<br>Uses the policy <a href=\"https://www.azadvertizer.net/azpolicyadvertizer/a8eff44f-8c92-45c3-a3fb-9880802d67a7.html\">Deploy Azure Policy Add-on to Azure Kubernetes Service clusters</a>.",
4383-
"constraints": {
4384-
"allowedValues": [
4385-
{
4386-
"label": "Yes (recommended)",
4387-
"value": "Yes"
4388-
},
4389-
{
4390-
"label": "Audit only",
4391-
"value": "Audit"
4392-
},
4393-
{
4394-
"label": "No",
4395-
"value": "No"
4396-
}
4397-
]
4398-
},
4399-
"visible": true
4400-
},
44014357
{
44024358
"name": "denyAksPrivileged",
44034359
"type": "Microsoft.Common.OptionsGroup",
@@ -9073,7 +9029,6 @@
90739029
"enableVmMonitoring": "[steps('landingZones').lzSection.enableVmMonitoring]",
90749030
"enableVmssMonitoring": "[steps('landingZones').lzSection.enableVmssMonitoring]",
90759031
"enableVmHybridMonitoring": "[steps('landingZones').lzSection.enableVmHybridMonitoring]",
9076-
"enableAksPolicy": "[steps('landingZones').lzSection.enableAksPolicy]",
90779032
"denyAksPrivileged": "[steps('landingZones').lzSection.denyAksPrivileged]",
90789033
"denyAksPrivilegedEscalation": "[steps('landingZones').lzSection.denyAksPrivilegedEscalation]",
90799034
"denyHttpIngressForAks": "[steps('landingZones').lzSection.denyHttpIngressForAks]",

‎eslzArm/eslzArm.json

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -771,15 +771,6 @@
771771
"description": "If 'Yes' is selected, policy will be assigned to enforce Hybrid VM monitoring."
772772
}
773773
},
774-
"enableAksPolicy": {
775-
"type": "string",
776-
"defaultValue": "No",
777-
"allowedValues": [
778-
"Yes",
779-
"Audit",
780-
"No"
781-
]
782-
},
783774
"denyAksPrivileged": {
784775
"type": "string",
785776
"defaultValue": "No",
@@ -1610,7 +1601,6 @@
16101601
"azVmssMonitorPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-VMSSMonitoringPolicyAssignment.json')]",
16111602
"azVmHybridMonitorPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-VMHybridMonitoringPolicyAssignment.json')]",
16121603
"azVmBackupPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-VMBackupPolicyAssignment.json')]",
1613-
"azPolicyForAksPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-AksPolicyPolicyAssignment.json')]",
16141604
"aksPrivEscalationPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DENY-AksPrivEscalationPolicyAssignment.json')]",
16151605
"aksPrivilegedPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DENY-AksPrivilegedPolicyAssignment.json')]",
16161606
"tlsSslPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DENY-DINE-APPEND-TLS-SSL-PolicyAssignment.json')]",
@@ -1735,7 +1725,6 @@
17351725
"azVmHybridMonitorPolicyDeploymentName": "[take(concat('alz-AzVmHybridMonitor', variables('deploymentSuffix')), 64)]",
17361726
"azBackupLzPolicyDeploymentName": "[take(concat('alz-AzBackupLz', variables('deploymentSuffix')), 64)]",
17371727
"azBackupIdentityPolicyDeploymentName": "[take(concat('alz-AzBackupIdentity', variables('deploymentSuffix')), 64)]",
1738-
"azPolicyForAksPolicyDeploymentName": "[take(concat('alz-AksPolicy', variables('deploymentSuffix')), 64)]",
17391728
"aksPrivEscalationPolicyDeploymentName": "[take(concat('alz-AksPrivEsc', variables('deploymentSuffix')), 64)]",
17401729
"aksHttpsPolicyDeploymentName": "[take(concat('alz-AksHttps', variables('deploymentSuffix')), 64)]",
17411730
"aksPrivilegedPolicyDeploymentName": "[take(concat('alz-AksPrivileged', variables('deploymentSuffix')), 64)]",
@@ -6236,33 +6225,6 @@
62366225
}
62376226
}
62386227
},
6239-
{
6240-
// Assigning Azure Policy enablement policy for AKS to landing zones management group if condition is true
6241-
"condition": "[or(equals(parameters('enableAksPolicy'), 'Yes'), equals(parameters('enableAksPolicy'), 'Audit'))]",
6242-
"type": "Microsoft.Resources/deployments",
6243-
"apiVersion": "2020-10-01",
6244-
"name": "[variables('deploymentNames').azPolicyForAksPolicyDeploymentName]",
6245-
"scope": "[variables('scopes').lzsManagementGroup]",
6246-
"location": "[deployment().location]",
6247-
"dependsOn": [
6248-
"policyCompletion"
6249-
],
6250-
"properties": {
6251-
"mode": "Incremental",
6252-
"templateLink": {
6253-
"contentVersion": "1.0.0.0",
6254-
"uri": "[variables('deploymentUris').azPolicyForAksPolicyAssignment]"
6255-
},
6256-
"parameters": {
6257-
"topLevelManagementGroupPrefix": {
6258-
"value": "[parameters('enterpriseScaleCompanyPrefix')]"
6259-
},
6260-
"enforcementMode": {
6261-
"value": "[if(equals(parameters('enableaksPolicy'), 'Yes'), 'Default', 'DoNotEnforce')]"
6262-
}
6263-
}
6264-
}
6265-
},
62666228
{
62676229
// Assigning Aks Priv Escalation policy to landing zones management group if condition is true
62686230
"condition": "[or(equals(parameters('denyAksPrivilegedEscalation'), 'Yes'), equals(parameters('denyAksPrivilegedEscalation'), 'Audit'))]",

‎eslzArm/managementGroupTemplates/policyAssignments/DINE-AksPolicyPolicyAssignment.json

Lines changed: 0 additions & 80 deletions
This file was deleted.

0 commit comments

Comments
 (0)