Skip to content

Commit 49102ce

Browse files
deeikeledeeikele
committed
deny connection variants
1 parent 3642acb commit 49102ce

File tree

3 files changed

+223
-0
lines changed

3 files changed

+223
-0
lines changed

‎samples/microsoft/infrastructure-setup/05-custom-policy-definitions/README.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# Custom Azure Policy Samples for AI Foundry
2+
3+
Azure Policy enables you to put guardrails on resource configurations and enable self-serve resource creation in your organization. This repository shows examples for common scenarios in Azure AI Foundry.
4+
5+
## Available Policies
6+
7+
### 1. Deny Disallowed Connections (`deny-disallowed-connections.json`)
8+
This policy restricts AI Foundry project connections to only allow specific categories. By default, it only allows `CognitiveSearch` connections, but this can be customized via parameters.
9+
10+
**Policy Effect**: Deny
11+
**Scope**: Microsoft.CognitiveServices/accounts/projects/connections
12+
13+
### 2. Deny Key Authentication Connections (`deny-key-auth-connections.json`)
14+
This policy prevents the creation of connections that use key-based authentication methods.
15+
16+
### 3. Audit Enabled VNet Injection (`audit-enabled-vnet-injection.json`)
17+
This policy audits whether VNet injection is properly enabled for AI Foundry resources.
18+
19+
## Deployment
20+
21+
### Prerequisites
22+
- Azure CLI or Azure PowerShell
23+
- Appropriate permissions to create Azure Policy definitions and assignments
24+
- For subscription-level policies: Owner or Resource Policy Contributor role at subscription level
25+
- For management group-level policies: Owner or Resource Policy Contributor role at management group level
26+
27+
### Deploy using Azure CLI
28+
29+
1. **Login to Azure**
30+
```bash
31+
az login
32+
az account set --subscription "<your-subscription-id>"
33+
```
34+
35+
2. **Deploy the policy definition only**
36+
```bash
37+
az deployment sub create \
38+
--location "East US 2" \
39+
--template-file main.bicep \
40+
--parameters main.bicepparam
41+
```
42+
43+
3. **Deploy with policy assignment**
44+
```bash
45+
az deployment sub create \
46+
--location "East US 2" \
47+
--template-file main.bicep \
48+
--parameters main.bicepparam \
49+
--parameters assignPolicy=true
50+
```
51+
52+
### Deploy using Azure PowerShell
53+
54+
1. **Login to Azure**
55+
```powershell
56+
Connect-AzAccount
57+
Set-AzContext -SubscriptionId "<your-subscription-id>"
58+
```
59+
60+
2. **Deploy the policy definition only**
61+
```powershell
62+
New-AzSubscriptionDeployment `
63+
-Location "East US 2" `
64+
-TemplateFile "main.bicep" `
65+
-TemplateParameterFile "main.bicepparam"
66+
```
67+
68+
3. **Deploy with policy assignment**
69+
```powershell
70+
New-AzSubscriptionDeployment `
71+
-Location "East US 2" `
72+
-TemplateFile "main.bicep" `
73+
-TemplateParameterFile "main.bicepparam" `
74+
-assignPolicy $true
75+
```
76+
77+
### Customization
78+
79+
You can customize the deployment by modifying the parameters in `main.bicepparam`:
80+
81+
- **`policyName`**: Name for the policy definition
82+
- **`allowedCategories`**: Array of allowed connection categories (default: `['CognitiveSearch']`)
83+
- **`assignPolicy`**: Set to `true` to automatically assign the policy to the subscription
84+
- **`assignmentName`**: Name for the policy assignment (if enabled)
85+
- **`assignmentDisplayName`**: Display name for the policy assignment
86+
87+
### Alternative: Deploy using JSON policy definitions directly
88+
89+
If you prefer to use the JSON policy definitions directly without Bicep:
90+
91+
```bash
92+
# Create policy definition
93+
az policy definition create \
94+
--name "deny-disallowed-connections" \
95+
--display-name "Foundry Developer Platform Connections Can only be AIService" \
96+
--description "Foundry Developer Platform Connections Can only be AIService" \
97+
--rules "deny-disallowed-connections.json" \
98+
--mode "All"
99+
100+
# Assign the policy (optional)
101+
az policy assignment create \
102+
--name "deny-disallowed-connections-assignment" \
103+
--display-name "Assignment: Foundry Developer Platform Connections Can only be AIService" \
104+
--policy "deny-disallowed-connections" \
105+
--params '{"allowedCategories":{"value":["CognitiveSearch"]}}'
106+
```
107+
108+
## Policy Testing
109+
110+
After deployment, you can test the policy by attempting to create a connection with a disallowed category:
111+
112+
1. Navigate to your AI Foundry project in the Azure portal
113+
2. Try to create a new connection with a category not in the allowed list
114+
3. The operation should be denied with a policy violation message
115+
116+
## Monitoring and Compliance
117+
118+
- Use Azure Policy compliance dashboard to monitor policy compliance
119+
- Set up alerts for policy violations
120+
- Review policy assignment effects regularly to ensure they meet your governance requirements

‎samples/microsoft/infrastructure-setup/05-custom-policy-definitions/deny-disallowed-connections.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"properties": {
3+
"displayName": "Only selected Foundry connection categories are allowed",
4+
"policyType": "Custom",
5+
"mode": "All",
6+
"description": "Only selected Foundry connection categories are allowed",
7+
"version": "1.0.0",
8+
"parameters": {
9+
"allowedCategories": {
10+
"type": "Array",
11+
"metadata": {
12+
"description": "Categories allowed for Microsoft.CognitiveServices/accounts/connections and Microsoft.CognitiveServices/accounts/projects/connections",
13+
"displayName": "Allowed connection categories"
14+
},
15+
"defaultValue": [
16+
"CognitiveSearch"
17+
]
18+
}
19+
},
20+
"policyRule": {
21+
"if": {
22+
"anyOf": [
23+
{
24+
"allOf": [
25+
{
26+
"field": "type",
27+
"equals": "Microsoft.CognitiveServices/accounts/connections"
28+
},
29+
{
30+
"field": "Microsoft.CognitiveServices/accounts/connections/category",
31+
"notIn": "[parameters('allowedCategories')]"
32+
}
33+
]
34+
},
35+
{
36+
"allOf": [
37+
{
38+
"field": "type",
39+
"equals": "Microsoft.CognitiveServices/accounts/projects/connections"
40+
},
41+
{
42+
"field": "Microsoft.CognitiveServices/accounts/projects/connections/category",
43+
"notIn": "[parameters('allowedCategories')]"
44+
}
45+
]
46+
}
47+
]
48+
},
49+
"then": {
50+
"effect": "deny"
51+
}
52+
},
53+
"versions": [
54+
"1.0.0"
55+
]
56+
}
57+
}

‎samples/microsoft/infrastructure-setup/05-custom-policy-definitions/deny-key-auth-connections.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"properties": {
3+
"displayName": "Deny AI Foundry connections using API key-based authentication",
4+
"policyType": "Custom",
5+
"mode": "All",
6+
"description": "This policy denies the creation of connections that use API key authentication for enhanced security",
7+
"version": "1.0.0",
8+
"parameters": {},
9+
"policyRule": {
10+
"if": {
11+
"anyOf": [
12+
{
13+
"allOf": [
14+
{
15+
"field": "type",
16+
"equals": "Microsoft.CognitiveServices/accounts/projects/connections"
17+
},
18+
{
19+
"field": "Microsoft.CognitiveServices/accounts/projects/connections/authType",
20+
"equals": "ApiKey"
21+
}
22+
]
23+
},
24+
{
25+
"allOf": [
26+
{
27+
"field": "type",
28+
"equals": "Microsoft.CognitiveServices/accounts/connections"
29+
},
30+
{
31+
"field": "Microsoft.CognitiveServices/accounts/connections/authType",
32+
"equals": "ApiKey"
33+
}
34+
]
35+
}
36+
]
37+
},
38+
"then": {
39+
"effect": "deny"
40+
}
41+
},
42+
"versions": [
43+
"1.0.0"
44+
]
45+
}
46+
}

0 commit comments

Comments
 (0)