Azure Policy
As mentioned earlier in this chapter, Azure Policy can help us to provide centralized control of Azure resources. Policies can apply to resource creation or be evaluated after the creation of the resource is complete, which is most common for in-guest configuration in virtual machines.
Policies can be deployed in the following ways:
- Audit mode
- Deny mode
- AuditIfNotExists
- DeployIfNotExists
These policies work by looking at the different Azure Resource Manager (ARM) attributes to determine whether a resource is compliant according to the policy or not. For instance, if we deploy a virtual machine within a specific region, the ARM attributes for that VM are going to contain the following:
"type": "Microsoft.Compute/virtualMachines", "apiVersion": "2021-11-01"...