DenyAction sample

johnthebrit · Dec 7, 2022 · 0153069 · 0153069
1 parent 85aa8e6
commit 0153069
Showing 1 changed file with 38 additions and 0 deletions.
diff --git a/AzurePolicy/DenyActionSample.json b/AzurePolicy/DenyActionSample.json
@@ -0,0 +1,38 @@
+{
+	"mode": "Indexed",
+	"policyRule": {
+        "if": {
+            "anyOf": [
+                {
+                "field": "tags.lockstatus",
+                "equals": "lock"
+                },
+                {
+                "allOf": [
+                    {
+                    "field": "type",
+                    "equals": "Microsoft.Storage/storageAccounts"
+                    },
+                    {
+                    "value": "[take(field('name'),9)]",
+                    "match": "stg##prod"
+                    }
+                ]
+                }
+            ]
+            },
+            "then": {
+            "effect": "DenyAction",
+            "details": {
+                "actionNames": [
+                "delete"
+                ],
+                "cascadeBehaviors": {
+                "resourceGroup": "deny"
+                }
+            }
+        }
+    }
+	,
+	"parameters": {}
+}